source3/libsmb/cliconnect.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    client connect/disconnect routines
   4    Copyright (C) Andrew Tridgell 1994-1998
   5    Copyright (C) Andrew Bartlett 2001-2003
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "../libcli/auth/libcli_auth.h"
  23 #include "../libcli/auth/spnego.h"
  24
  25 static const struct {
  26         int prot;
  27         const char name[24];
  28 } prots[10] = {
  29         {PROTOCOL_CORE,         "PC NETWORK PROGRAM 1.0"},
  30         {PROTOCOL_COREPLUS,     "MICROSOFT NETWORKS 1.03"},
  31         {PROTOCOL_LANMAN1,      "MICROSOFT NETWORKS 3.0"},
  32         {PROTOCOL_LANMAN1,      "LANMAN1.0"},
  33         {PROTOCOL_LANMAN2,      "LM1.2X002"},
  34         {PROTOCOL_LANMAN2,      "DOS LANMAN2.1"},
  35         {PROTOCOL_LANMAN2,      "LANMAN2.1"},
  36         {PROTOCOL_LANMAN2,      "Samba"},
  37         {PROTOCOL_NT1,          "NT LANMAN 1.0"},
  38         {PROTOCOL_NT1,          "NT LM 0.12"},
  39 };
  40
  41 #define STAR_SMBSERVER "*SMBSERVER"
  42
  43 /**
  44  * Set the user session key for a connection
  45  * @param cli The cli structure to add it too
  46  * @param session_key The session key used.  (A copy of this is taken for the cli struct)
  47  *
  48  */
  49
  50 static void cli_set_session_key (struct cli_state *cli, const DATA_BLOB session_key)
  51 {
  52         cli->user_session_key = data_blob(session_key.data, session_key.length);
  53 }
  54
  55 /****************************************************************************
  56  Do an old lanman2 style session setup.
  57 ****************************************************************************/
  58
  59 static NTSTATUS cli_session_setup_lanman2(struct cli_state *cli,
  60                                           const char *user,
  61                                           const char *pass, size_t passlen,
  62                                           const char *workgroup)
  63 {
  64         DATA_BLOB session_key = data_blob_null;
  65         DATA_BLOB lm_response = data_blob_null;
  66         NTSTATUS status;
  67         fstring pword;
  68         char *p;
  69
  70         if (passlen > sizeof(pword)-1) {
  71                 return NT_STATUS_INVALID_PARAMETER;
  72         }
  73
  74         /* LANMAN servers predate NT status codes and Unicode and ignore those
  75            smb flags so we must disable the corresponding default capabilities
  76            that would otherwise cause the Unicode and NT Status flags to be
  77            set (and even returned by the server) */
  78
  79         cli->capabilities &= ~(CAP_UNICODE | CAP_STATUS32);
  80
  81         /* if in share level security then don't send a password now */
  82         if (!(cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL))
  83                 passlen = 0;
  84
  85         if (passlen > 0 && (cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) && passlen != 24) {
  86                 /* Encrypted mode needed, and non encrypted password supplied. */
  87                 lm_response = data_blob(NULL, 24);
  88                 if (!SMBencrypt(pass, cli->secblob.data,(uchar *)lm_response.data)) {
  89                         DEBUG(1, ("Password is > 14 chars in length, and is therefore incompatible with Lanman authentication\n"));
  90                         return NT_STATUS_ACCESS_DENIED;
  91                 }
  92         } else if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) && passlen == 24) {
  93                 /* Encrypted mode needed, and encrypted password supplied. */
  94                 lm_response = data_blob(pass, passlen);
  95         } else if (passlen > 0) {
  96                 /* Plaintext mode needed, assume plaintext supplied. */
  97                 passlen = clistr_push(cli, pword, pass, sizeof(pword), STR_TERMINATE);
  98                 lm_response = data_blob(pass, passlen);
  99         }
 100
 101         /* send a session setup command */
 102         memset(cli->outbuf,'\0',smb_size);
 103         cli_set_message(cli->outbuf,10, 0, True);
 104         SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
 105         cli_setup_packet(cli);
 106
 107         SCVAL(cli->outbuf,smb_vwv0,0xFF);
 108         SSVAL(cli->outbuf,smb_vwv2,cli->max_xmit);
 109         SSVAL(cli->outbuf,smb_vwv3,2);
 110         SSVAL(cli->outbuf,smb_vwv4,1);
 111         SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
 112         SSVAL(cli->outbuf,smb_vwv7,lm_response.length);
 113
 114         p = smb_buf(cli->outbuf);
 115         memcpy(p,lm_response.data,lm_response.length);
 116         p += lm_response.length;
 117         p += clistr_push(cli, p, user, -1, STR_TERMINATE|STR_UPPER);
 118         p += clistr_push(cli, p, workgroup, -1, STR_TERMINATE|STR_UPPER);
 119         p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
 120         p += clistr_push(cli, p, "Samba", -1, STR_TERMINATE);
 121         cli_setup_bcc(cli, p);
 122
 123         if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
 124                 return cli_nt_error(cli);
 125         }
 126
 127         show_msg(cli->inbuf);
 128
 129         if (cli_is_error(cli)) {
 130                 return cli_nt_error(cli);
 131         }
 132
 133         /* use the returned vuid from now on */
 134         cli->vuid = SVAL(cli->inbuf,smb_uid);
 135         status = cli_set_username(cli, user);
 136         if (!NT_STATUS_IS_OK(status)) {
 137                 return status;
 138         }
 139
 140         if (session_key.data) {
 141                 /* Have plaintext orginal */
 142                 cli_set_session_key(cli, session_key);
 143         }
 144
 145         return NT_STATUS_OK;
 146 }
 147
 148 /****************************************************************************
 149  Work out suitable capabilities to offer the server.
 150 ****************************************************************************/
 151
 152 static uint32 cli_session_setup_capabilities(struct cli_state *cli)
 153 {
 154         uint32 capabilities = CAP_NT_SMBS;
 155
 156         if (!cli->force_dos_errors)
 157                 capabilities |= CAP_STATUS32;
 158
 159         if (cli->use_level_II_oplocks)
 160                 capabilities |= CAP_LEVEL_II_OPLOCKS;
 161
 162         capabilities |= (cli->capabilities & (CAP_UNICODE|CAP_LARGE_FILES|CAP_LARGE_READX|CAP_LARGE_WRITEX|CAP_DFS));
 163         return capabilities;
 164 }
 165
 166 /****************************************************************************
 167  Do a NT1 guest session setup.
 168 ****************************************************************************/
 169
 170 struct cli_session_setup_guest_state {
 171         struct cli_state *cli;
 172         uint16_t vwv[16];
 173         struct iovec bytes;
 174 };
 175
 176 static void cli_session_setup_guest_done(struct tevent_req *subreq);
 177
 178 struct tevent_req *cli_session_setup_guest_create(TALLOC_CTX *mem_ctx,
 179                                                   struct event_context *ev,
 180                                                   struct cli_state *cli,
 181                                                   struct tevent_req **psmbreq)
 182 {
 183         struct tevent_req *req, *subreq;
 184         struct cli_session_setup_guest_state *state;
 185         uint16_t *vwv;
 186         uint8_t *bytes;
 187
 188         req = tevent_req_create(mem_ctx, &state,
 189                                 struct cli_session_setup_guest_state);
 190         if (req == NULL) {
 191                 return NULL;
 192         }
 193         state->cli = cli;
 194         vwv = state->vwv;
 195
 196         SCVAL(vwv+0, 0, 0xFF);
 197         SCVAL(vwv+0, 1, 0);
 198         SSVAL(vwv+1, 0, 0);
 199         SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
 200         SSVAL(vwv+3, 0, 2);
 201         SSVAL(vwv+4, 0, cli->pid);
 202         SIVAL(vwv+5, 0, cli->sesskey);
 203         SSVAL(vwv+7, 0, 0);
 204         SSVAL(vwv+8, 0, 0);
 205         SSVAL(vwv+9, 0, 0);
 206         SSVAL(vwv+10, 0, 0);
 207         SIVAL(vwv+11, 0, cli_session_setup_capabilities(cli));
 208
 209         bytes = talloc_array(state, uint8_t, 0);
 210
 211         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "",  1, /* username */
 212                                    NULL);
 213         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "", 1, /* workgroup */
 214                                    NULL);
 215         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Unix", 5, NULL);
 216         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Samba", 6, NULL);
 217
 218         if (bytes == NULL) {
 219                 TALLOC_FREE(req);
 220                 return NULL;
 221         }
 222
 223         state->bytes.iov_base = (void *)bytes;
 224         state->bytes.iov_len = talloc_get_size(bytes);
 225
 226         subreq = cli_smb_req_create(state, ev, cli, SMBsesssetupX, 0, 13, vwv,
 227                                     1, &state->bytes);
 228         if (subreq == NULL) {
 229                 TALLOC_FREE(req);
 230                 return NULL;
 231         }
 232         tevent_req_set_callback(subreq, cli_session_setup_guest_done, req);
 233         *psmbreq = subreq;
 234         return req;
 235 }
 236
 237 struct tevent_req *cli_session_setup_guest_send(TALLOC_CTX *mem_ctx,
 238                                                 struct event_context *ev,
 239                                                 struct cli_state *cli)
 240 {
 241         struct tevent_req *req, *subreq;
 242         NTSTATUS status;
 243
 244         req = cli_session_setup_guest_create(mem_ctx, ev, cli, &subreq);
 245         if (req == NULL) {
 246                 return NULL;
 247         }
 248
 249         status = cli_smb_req_send(subreq);
 250         if (NT_STATUS_IS_OK(status)) {
 251                 tevent_req_nterror(req, status);
 252                 return tevent_req_post(req, ev);
 253         }
 254         return req;
 255 }
 256
 257 static void cli_session_setup_guest_done(struct tevent_req *subreq)
 258 {
 259         struct tevent_req *req = tevent_req_callback_data(
 260                 subreq, struct tevent_req);
 261         struct cli_session_setup_guest_state *state = tevent_req_data(
 262                 req, struct cli_session_setup_guest_state);
 263         struct cli_state *cli = state->cli;
 264         uint32_t num_bytes;
 265         char *inbuf;
 266         uint8_t *bytes;
 267         uint8_t *p;
 268         NTSTATUS status;
 269
 270         status = cli_smb_recv(subreq, 0, NULL, NULL, &num_bytes, &bytes);
 271         if (!NT_STATUS_IS_OK(status)) {
 272                 TALLOC_FREE(subreq);
 273                 tevent_req_nterror(req, status);
 274                 return;
 275         }
 276
 277         inbuf = (char *)cli_smb_inbuf(subreq);
 278         p = bytes;
 279
 280         cli->vuid = SVAL(inbuf, smb_uid);
 281
 282         p += clistr_pull(inbuf, cli->server_os, (char *)p, sizeof(fstring),
 283                          bytes+num_bytes-p, STR_TERMINATE);
 284         p += clistr_pull(inbuf, cli->server_type, (char *)p, sizeof(fstring),
 285                          bytes+num_bytes-p, STR_TERMINATE);
 286         p += clistr_pull(inbuf, cli->server_domain, (char *)p, sizeof(fstring),
 287                          bytes+num_bytes-p, STR_TERMINATE);
 288
 289         if (strstr(cli->server_type, "Samba")) {
 290                 cli->is_samba = True;
 291         }
 292
 293         TALLOC_FREE(subreq);
 294
 295         status = cli_set_username(cli, "");
 296         if (!NT_STATUS_IS_OK(status)) {
 297                 tevent_req_nterror(req, status);
 298                 return;
 299         }
 300         tevent_req_done(req);
 301 }
 302
 303 NTSTATUS cli_session_setup_guest_recv(struct tevent_req *req)
 304 {
 305         return tevent_req_simple_recv_ntstatus(req);
 306 }
 307
 308 static NTSTATUS cli_session_setup_guest(struct cli_state *cli)
 309 {
 310         TALLOC_CTX *frame = talloc_stackframe();
 311         struct event_context *ev;
 312         struct tevent_req *req;
 313         NTSTATUS status = NT_STATUS_OK;
 314
 315         if (cli_has_async_calls(cli)) {
 316                 /*
 317                  * Can't use sync call while an async call is in flight
 318                  */
 319                 status = NT_STATUS_INVALID_PARAMETER;
 320                 goto fail;
 321         }
 322
 323         ev = event_context_init(frame);
 324         if (ev == NULL) {
 325                 status = NT_STATUS_NO_MEMORY;
 326                 goto fail;
 327         }
 328
 329         req = cli_session_setup_guest_send(frame, ev, cli);
 330         if (req == NULL) {
 331                 status = NT_STATUS_NO_MEMORY;
 332                 goto fail;
 333         }
 334
 335         if (!tevent_req_poll(req, ev)) {
 336                 status = map_nt_error_from_unix(errno);
 337                 goto fail;
 338         }
 339
 340         status = cli_session_setup_guest_recv(req);
 341  fail:
 342         TALLOC_FREE(frame);
 343         if (!NT_STATUS_IS_OK(status)) {
 344                 cli_set_error(cli, status);
 345         }
 346         return status;
 347 }
 348
 349 /****************************************************************************
 350  Do a NT1 plaintext session setup.
 351 ****************************************************************************/
 352
 353 static NTSTATUS cli_session_setup_plaintext(struct cli_state *cli,
 354                                             const char *user, const char *pass,
 355                                             const char *workgroup)
 356 {
 357         uint32 capabilities = cli_session_setup_capabilities(cli);
 358         char *p;
 359         NTSTATUS status;
 360         fstring lanman;
 361
 362         fstr_sprintf( lanman, "Samba %s", samba_version_string());
 363
 364         memset(cli->outbuf, '\0', smb_size);
 365         cli_set_message(cli->outbuf,13,0,True);
 366         SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
 367         cli_setup_packet(cli);
 368
 369         SCVAL(cli->outbuf,smb_vwv0,0xFF);
 370         SSVAL(cli->outbuf,smb_vwv2,CLI_BUFFER_SIZE);
 371         SSVAL(cli->outbuf,smb_vwv3,2);
 372         SSVAL(cli->outbuf,smb_vwv4,cli->pid);
 373         SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
 374         SSVAL(cli->outbuf,smb_vwv8,0);
 375         SIVAL(cli->outbuf,smb_vwv11,capabilities);
 376         p = smb_buf(cli->outbuf);
 377
 378         /* check wether to send the ASCII or UNICODE version of the password */
 379
 380         if ( (capabilities & CAP_UNICODE) == 0 ) {
 381                 p += clistr_push(cli, p, pass, -1, STR_TERMINATE); /* password */
 382                 SSVAL(cli->outbuf,smb_vwv7,PTR_DIFF(p, smb_buf(cli->outbuf)));
 383         }
 384         else {
 385                 /* For ucs2 passwords clistr_push calls ucs2_align, which causes
 386                  * the space taken by the unicode password to be one byte too
 387                  * long (as we're on an odd byte boundary here). Reduce the
 388                  * count by 1 to cope with this. Fixes smbclient against NetApp
 389                  * servers which can't cope. Fix from
 390                  * bryan.kolodziej@allenlund.com in bug #3840.
 391                  */
 392                 p += clistr_push(cli, p, pass, -1, STR_UNICODE|STR_TERMINATE); /* unicode password */
 393                 SSVAL(cli->outbuf,smb_vwv8,PTR_DIFF(p, smb_buf(cli->outbuf))-1);
 394         }
 395
 396         p += clistr_push(cli, p, user, -1, STR_TERMINATE); /* username */
 397         p += clistr_push(cli, p, workgroup, -1, STR_TERMINATE); /* workgroup */
 398         p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
 399         p += clistr_push(cli, p, lanman, -1, STR_TERMINATE);
 400         cli_setup_bcc(cli, p);
 401
 402         if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
 403                 return cli_nt_error(cli);
 404         }
 405
 406         show_msg(cli->inbuf);
 407
 408         if (cli_is_error(cli)) {
 409                 return cli_nt_error(cli);
 410         }
 411
 412         cli->vuid = SVAL(cli->inbuf,smb_uid);
 413         p = smb_buf(cli->inbuf);
 414         p += clistr_pull(cli->inbuf, cli->server_os, p, sizeof(fstring),
 415                          -1, STR_TERMINATE);
 416         p += clistr_pull(cli->inbuf, cli->server_type, p, sizeof(fstring),
 417                          -1, STR_TERMINATE);
 418         p += clistr_pull(cli->inbuf, cli->server_domain, p, sizeof(fstring),
 419                          -1, STR_TERMINATE);
 420         status = cli_set_username(cli, user);
 421         if (!NT_STATUS_IS_OK(status)) {
 422                 return status;
 423         }
 424         if (strstr(cli->server_type, "Samba")) {
 425                 cli->is_samba = True;
 426         }
 427
 428         return NT_STATUS_OK;
 429 }
 430
 431 /****************************************************************************
 432    do a NT1 NTLM/LM encrypted session setup - for when extended security
 433    is not negotiated.
 434    @param cli client state to create do session setup on
 435    @param user username
 436    @param pass *either* cleartext password (passlen !=24) or LM response.
 437    @param ntpass NT response, implies ntpasslen >=24, implies pass is not clear
 438    @param workgroup The user's domain.
 439 ****************************************************************************/
 440
 441 static NTSTATUS cli_session_setup_nt1(struct cli_state *cli, const char *user,
 442                                       const char *pass, size_t passlen,
 443                                       const char *ntpass, size_t ntpasslen,
 444                                       const char *workgroup)
 445 {
 446         uint32 capabilities = cli_session_setup_capabilities(cli);
 447         DATA_BLOB lm_response = data_blob_null;
 448         DATA_BLOB nt_response = data_blob_null;
 449         DATA_BLOB session_key = data_blob_null;
 450         NTSTATUS result;
 451         char *p;
 452         bool ok;
 453
 454         if (passlen == 0) {
 455                 /* do nothing - guest login */
 456         } else if (passlen != 24) {
 457                 if (lp_client_ntlmv2_auth()) {
 458                         DATA_BLOB server_chal;
 459                         DATA_BLOB names_blob;
 460                         server_chal = data_blob(cli->secblob.data, MIN(cli->secblob.length, 8));
 461
 462                         /* note that the 'workgroup' here is a best guess - we don't know
 463                            the server's domain at this point.  The 'server name' is also
 464                            dodgy...
 465                         */
 466                         names_blob = NTLMv2_generate_names_blob(NULL, cli->called.name, workgroup);
 467
 468                         if (!SMBNTLMv2encrypt(NULL, user, workgroup, pass, &server_chal,
 469                                               &names_blob,
 470                                               &lm_response, &nt_response, NULL, &session_key)) {
 471                                 data_blob_free(&names_blob);
 472                                 data_blob_free(&server_chal);
 473                                 return NT_STATUS_ACCESS_DENIED;
 474                         }
 475                         data_blob_free(&names_blob);
 476                         data_blob_free(&server_chal);
 477
 478                 } else {
 479                         uchar nt_hash[16];
 480                         E_md4hash(pass, nt_hash);
 481
 482 #ifdef LANMAN_ONLY
 483                         nt_response = data_blob_null;
 484 #else
 485                         nt_response = data_blob(NULL, 24);
 486                         SMBNTencrypt(pass,cli->secblob.data,nt_response.data);
 487 #endif
 488                         /* non encrypted password supplied. Ignore ntpass. */
 489                         if (lp_client_lanman_auth()) {
 490                                 lm_response = data_blob(NULL, 24);
 491                                 if (!SMBencrypt(pass,cli->secblob.data, lm_response.data)) {
 492                                         /* Oops, the LM response is invalid, just put
 493                                            the NT response there instead */
 494                                         data_blob_free(&lm_response);
 495                                         lm_response = data_blob(nt_response.data, nt_response.length);
 496                                 }
 497                         } else {
 498                                 /* LM disabled, place NT# in LM field instead */
 499                                 lm_response = data_blob(nt_response.data, nt_response.length);
 500                         }
 501
 502                         session_key = data_blob(NULL, 16);
 503 #ifdef LANMAN_ONLY
 504                         E_deshash(pass, session_key.data);
 505                         memset(&session_key.data[8], '\0', 8);
 506 #else
 507                         SMBsesskeygen_ntv1(nt_hash, session_key.data);
 508 #endif
 509                 }
 510                 cli_temp_set_signing(cli);
 511         } else {
 512                 /* pre-encrypted password supplied.  Only used for
 513                    security=server, can't do
 514                    signing because we don't have original key */
 515
 516                 lm_response = data_blob(pass, passlen);
 517                 nt_response = data_blob(ntpass, ntpasslen);
 518         }
 519
 520         /* send a session setup command */
 521         memset(cli->outbuf,'\0',smb_size);
 522
 523         cli_set_message(cli->outbuf,13,0,True);
 524         SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
 525         cli_setup_packet(cli);
 526
 527         SCVAL(cli->outbuf,smb_vwv0,0xFF);
 528         SSVAL(cli->outbuf,smb_vwv2,CLI_BUFFER_SIZE);
 529         SSVAL(cli->outbuf,smb_vwv3,2);
 530         SSVAL(cli->outbuf,smb_vwv4,cli->pid);
 531         SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
 532         SSVAL(cli->outbuf,smb_vwv7,lm_response.length);
 533         SSVAL(cli->outbuf,smb_vwv8,nt_response.length);
 534         SIVAL(cli->outbuf,smb_vwv11,capabilities);
 535         p = smb_buf(cli->outbuf);
 536         if (lm_response.length) {
 537                 memcpy(p,lm_response.data, lm_response.length); p += lm_response.length;
 538         }
 539         if (nt_response.length) {
 540                 memcpy(p,nt_response.data, nt_response.length); p += nt_response.length;
 541         }
 542         p += clistr_push(cli, p, user, -1, STR_TERMINATE);
 543
 544         /* Upper case here might help some NTLMv2 implementations */
 545         p += clistr_push(cli, p, workgroup, -1, STR_TERMINATE|STR_UPPER);
 546         p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
 547         p += clistr_push(cli, p, "Samba", -1, STR_TERMINATE);
 548         cli_setup_bcc(cli, p);
 549
 550         if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
 551                 result = cli_nt_error(cli);
 552                 goto end;
 553         }
 554
 555         /* show_msg(cli->inbuf); */
 556
 557         if (cli_is_error(cli)) {
 558                 result = cli_nt_error(cli);
 559                 goto end;
 560         }
 561
 562 #ifdef LANMAN_ONLY
 563         ok = cli_simple_set_signing(cli, session_key, lm_response);
 564 #else
 565         ok = cli_simple_set_signing(cli, session_key, nt_response);
 566 #endif
 567         if (ok) {
 568                 if (!cli_check_sign_mac(cli, cli->inbuf, 1)) {
 569                         result = NT_STATUS_ACCESS_DENIED;
 570                         goto end;
 571                 }
 572         }
 573
 574         /* use the returned vuid from now on */
 575         cli->vuid = SVAL(cli->inbuf,smb_uid);
 576
 577         p = smb_buf(cli->inbuf);
 578         p += clistr_pull(cli->inbuf, cli->server_os, p, sizeof(fstring),
 579                          -1, STR_TERMINATE);
 580         p += clistr_pull(cli->inbuf, cli->server_type, p, sizeof(fstring),
 581                          -1, STR_TERMINATE);
 582         p += clistr_pull(cli->inbuf, cli->server_domain, p, sizeof(fstring),
 583                          -1, STR_TERMINATE);
 584
 585         if (strstr(cli->server_type, "Samba")) {
 586                 cli->is_samba = True;
 587         }
 588
 589         result = cli_set_username(cli, user);
 590         if (!NT_STATUS_IS_OK(result)) {
 591                 goto end;
 592         }
 593
 594         if (session_key.data) {
 595                 /* Have plaintext orginal */
 596                 cli_set_session_key(cli, session_key);
 597         }
 598
 599         result = NT_STATUS_OK;
 600 end:
 601         data_blob_free(&lm_response);
 602         data_blob_free(&nt_response);
 603         data_blob_free(&session_key);
 604         return result;
 605 }
 606
 607 /****************************************************************************
 608  Send a extended security session setup blob
 609 ****************************************************************************/
 610
 611 static bool cli_session_setup_blob_send(struct cli_state *cli, DATA_BLOB blob)
 612 {
 613         uint32 capabilities = cli_session_setup_capabilities(cli);
 614         char *p;
 615
 616         capabilities |= CAP_EXTENDED_SECURITY;
 617
 618         /* send a session setup command */
 619         memset(cli->outbuf,'\0',smb_size);
 620
 621         cli_set_message(cli->outbuf,12,0,True);
 622         SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
 623
 624         cli_setup_packet(cli);
 625
 626         SCVAL(cli->outbuf,smb_vwv0,0xFF);
 627         SSVAL(cli->outbuf,smb_vwv2,CLI_BUFFER_SIZE);
 628         SSVAL(cli->outbuf,smb_vwv3,2);
 629         SSVAL(cli->outbuf,smb_vwv4,1);
 630         SIVAL(cli->outbuf,smb_vwv5,0);
 631         SSVAL(cli->outbuf,smb_vwv7,blob.length);
 632         SIVAL(cli->outbuf,smb_vwv10,capabilities);
 633         p = smb_buf(cli->outbuf);
 634         memcpy(p, blob.data, blob.length);
 635         p += blob.length;
 636         p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
 637         p += clistr_push(cli, p, "Samba", -1, STR_TERMINATE);
 638         cli_setup_bcc(cli, p);
 639         return cli_send_smb(cli);
 640 }
 641
 642 /****************************************************************************
 643  Send a extended security session setup blob, returning a reply blob.
 644 ****************************************************************************/
 645
 646 static DATA_BLOB cli_session_setup_blob_receive(struct cli_state *cli)
 647 {
 648         DATA_BLOB blob2 = data_blob_null;
 649         char *p;
 650         size_t len;
 651
 652         if (!cli_receive_smb(cli))
 653                 return blob2;
 654
 655         show_msg(cli->inbuf);
 656
 657         if (cli_is_error(cli) && !NT_STATUS_EQUAL(cli_nt_error(cli),
 658                                                   NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 659                 return blob2;
 660         }
 661
 662         /* use the returned vuid from now on */
 663         cli->vuid = SVAL(cli->inbuf,smb_uid);
 664
 665         p = smb_buf(cli->inbuf);
 666
 667         blob2 = data_blob(p, SVAL(cli->inbuf, smb_vwv3));
 668
 669         p += blob2.length;
 670         p += clistr_pull(cli->inbuf, cli->server_os, p, sizeof(fstring),
 671                          -1, STR_TERMINATE);
 672
 673         /* w2k with kerberos doesn't properly null terminate this field */
 674         len = smb_bufrem(cli->inbuf, p);
 675         if (p + len < cli->inbuf + cli->bufsize+SAFETY_MARGIN - 2) {
 676                 char *end_of_buf = p + len;
 677
 678                 SSVAL(p, len, 0);
 679                 /* Now it's null terminated. */
 680                 p += clistr_pull(cli->inbuf, cli->server_type, p, sizeof(fstring),
 681                         -1, STR_TERMINATE);
 682                 /*
 683                  * See if there's another string. If so it's the
 684                  * server domain (part of the 'standard' Samba
 685                  * server signature).
 686                  */
 687                 if (p < end_of_buf) {
 688                         p += clistr_pull(cli->inbuf, cli->server_domain, p, sizeof(fstring),
 689                                 -1, STR_TERMINATE);
 690                 }
 691         } else {
 692                 /*
 693                  * No room to null terminate so we can't see if there
 694                  * is another string (server_domain) afterwards.
 695                  */
 696                 p += clistr_pull(cli->inbuf, cli->server_type, p, sizeof(fstring),
 697                                  len, 0);
 698         }
 699         return blob2;
 700 }
 701
 702 #ifdef HAVE_KRB5
 703 /****************************************************************************
 704  Send a extended security session setup blob, returning a reply blob.
 705 ****************************************************************************/
 706
 707 /* The following is calculated from :
 708  * (smb_size-4) = 35
 709  * (smb_wcnt * 2) = 24 (smb_wcnt == 12 in cli_session_setup_blob_send() )
 710  * (strlen("Unix") + 1 + strlen("Samba") + 1) * 2 = 22 (unicode strings at
 711  * end of packet.
 712  */
 713
 714 #define BASE_SESSSETUP_BLOB_PACKET_SIZE (35 + 24 + 22)
 715
 716 static bool cli_session_setup_blob(struct cli_state *cli, DATA_BLOB blob)
 717 {
 718         int32 remaining = blob.length;
 719         int32 cur = 0;
 720         DATA_BLOB send_blob = data_blob_null;
 721         int32 max_blob_size = 0;
 722         DATA_BLOB receive_blob = data_blob_null;
 723
 724         if (cli->max_xmit < BASE_SESSSETUP_BLOB_PACKET_SIZE + 1) {
 725                 DEBUG(0,("cli_session_setup_blob: cli->max_xmit too small "
 726                         "(was %u, need minimum %u)\n",
 727                         (unsigned int)cli->max_xmit,
 728                         BASE_SESSSETUP_BLOB_PACKET_SIZE));
 729                 cli_set_nt_error(cli, NT_STATUS_INVALID_PARAMETER);
 730                 return False;
 731         }
 732
 733         max_blob_size = cli->max_xmit - BASE_SESSSETUP_BLOB_PACKET_SIZE;
 734
 735         while ( remaining > 0) {
 736                 if (remaining >= max_blob_size) {
 737                         send_blob.length = max_blob_size;
 738                         remaining -= max_blob_size;
 739                 } else {
 740                         send_blob.length = remaining;
 741                         remaining = 0;
 742                 }
 743
 744                 send_blob.data =  &blob.data[cur];
 745                 cur += send_blob.length;
 746
 747                 DEBUG(10, ("cli_session_setup_blob: Remaining (%u) sending (%u) current (%u)\n",
 748                         (unsigned int)remaining,
 749                         (unsigned int)send_blob.length,
 750                         (unsigned int)cur ));
 751
 752                 if (!cli_session_setup_blob_send(cli, send_blob)) {
 753                         DEBUG(0, ("cli_session_setup_blob: send failed\n"));
 754                         return False;
 755                 }
 756
 757                 receive_blob = cli_session_setup_blob_receive(cli);
 758                 data_blob_free(&receive_blob);
 759
 760                 if (cli_is_error(cli) &&
 761                                 !NT_STATUS_EQUAL( cli_get_nt_error(cli),
 762                                         NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 763                         DEBUG(0, ("cli_session_setup_blob: receive failed "
 764                                   "(%s)\n", nt_errstr(cli_get_nt_error(cli))));
 765                         cli->vuid = 0;
 766                         return False;
 767                 }
 768         }
 769
 770         return True;
 771 }
 772
 773 /****************************************************************************
 774  Use in-memory credentials cache
 775 ****************************************************************************/
 776
 777 static void use_in_memory_ccache(void) {
 778         setenv(KRB5_ENV_CCNAME, "MEMORY:cliconnect", 1);
 779 }
 780
 781 /****************************************************************************
 782  Do a spnego/kerberos encrypted session setup.
 783 ****************************************************************************/
 784
 785 static ADS_STATUS cli_session_setup_kerberos(struct cli_state *cli, const char *principal, const char *workgroup)
 786 {
 787         DATA_BLOB negTokenTarg;
 788         DATA_BLOB session_key_krb5;
 789         NTSTATUS nt_status;
 790         int rc;
 791
 792         cli_temp_set_signing(cli);
 793
 794         DEBUG(2,("Doing kerberos session setup\n"));
 795
 796         /* generate the encapsulated kerberos5 ticket */
 797         rc = spnego_gen_negTokenTarg(principal, 0, &negTokenTarg, &session_key_krb5, 0, NULL);
 798
 799         if (rc) {
 800                 DEBUG(1, ("cli_session_setup_kerberos: spnego_gen_negTokenTarg failed: %s\n",
 801                         error_message(rc)));
 802                 return ADS_ERROR_KRB5(rc);
 803         }
 804
 805 #if 0
 806         file_save("negTokenTarg.dat", negTokenTarg.data, negTokenTarg.length);
 807 #endif
 808
 809         if (!cli_session_setup_blob(cli, negTokenTarg)) {
 810                 nt_status = cli_nt_error(cli);
 811                 goto nt_error;
 812         }
 813
 814         if (cli_is_error(cli)) {
 815                 nt_status = cli_nt_error(cli);
 816                 if (NT_STATUS_IS_OK(nt_status)) {
 817                         nt_status = NT_STATUS_UNSUCCESSFUL;
 818                 }
 819                 goto nt_error;
 820         }
 821
 822         cli_set_session_key(cli, session_key_krb5);
 823
 824         if (cli_simple_set_signing(
 825                     cli, session_key_krb5, data_blob_null)) {
 826
 827                 if (!cli_check_sign_mac(cli, cli->inbuf, 1)) {
 828                         nt_status = NT_STATUS_ACCESS_DENIED;
 829                         goto nt_error;
 830                 }
 831         }
 832
 833         data_blob_free(&negTokenTarg);
 834         data_blob_free(&session_key_krb5);
 835
 836         return ADS_ERROR_NT(NT_STATUS_OK);
 837
 838 nt_error:
 839         data_blob_free(&negTokenTarg);
 840         data_blob_free(&session_key_krb5);
 841         cli->vuid = 0;
 842         return ADS_ERROR_NT(nt_status);
 843 }
 844 #endif  /* HAVE_KRB5 */
 845
 846
 847 /****************************************************************************
 848  Do a spnego/NTLMSSP encrypted session setup.
 849 ****************************************************************************/
 850
 851 static NTSTATUS cli_session_setup_ntlmssp(struct cli_state *cli, const char *user,
 852                                           const char *pass, const char *domain)
 853 {
 854         struct ntlmssp_state *ntlmssp_state;
 855         NTSTATUS nt_status;
 856         int turn = 1;
 857         DATA_BLOB msg1;
 858         DATA_BLOB blob = data_blob_null;
 859         DATA_BLOB blob_in = data_blob_null;
 860         DATA_BLOB blob_out = data_blob_null;
 861
 862         cli_temp_set_signing(cli);
 863
 864         if (!NT_STATUS_IS_OK(nt_status = ntlmssp_client_start(&ntlmssp_state))) {
 865                 return nt_status;
 866         }
 867         ntlmssp_want_feature(ntlmssp_state, NTLMSSP_FEATURE_SESSION_KEY);
 868
 869         if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_username(ntlmssp_state, user))) {
 870                 return nt_status;
 871         }
 872         if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_domain(ntlmssp_state, domain))) {
 873                 return nt_status;
 874         }
 875         if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_password(ntlmssp_state, pass))) {
 876                 return nt_status;
 877         }
 878
 879         do {
 880                 nt_status = ntlmssp_update(ntlmssp_state,
 881                                                   blob_in, &blob_out);
 882                 data_blob_free(&blob_in);
 883                 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED) || NT_STATUS_IS_OK(nt_status)) {
 884                         if (turn == 1) {
 885                                 /* and wrap it in a SPNEGO wrapper */
 886                                 msg1 = gen_negTokenInit(OID_NTLMSSP, blob_out);
 887                         } else {
 888                                 /* wrap it in SPNEGO */
 889                                 msg1 = spnego_gen_auth(blob_out);
 890                         }
 891
 892                         /* now send that blob on its way */
 893                         if (!cli_session_setup_blob_send(cli, msg1)) {
 894                                 DEBUG(3, ("Failed to send NTLMSSP/SPNEGO blob to server!\n"));
 895                                 nt_status = NT_STATUS_UNSUCCESSFUL;
 896                         } else {
 897                                 blob = cli_session_setup_blob_receive(cli);
 898
 899                                 nt_status = cli_nt_error(cli);
 900                                 if (cli_is_error(cli) && NT_STATUS_IS_OK(nt_status)) {
 901                                         if (cli->smb_rw_error == SMB_READ_BAD_SIG) {
 902                                                 nt_status = NT_STATUS_ACCESS_DENIED;
 903                                         } else {
 904                                                 nt_status = NT_STATUS_UNSUCCESSFUL;
 905                                         }
 906                                 }
 907                         }
 908                         data_blob_free(&msg1);
 909                 }
 910
 911                 if (!blob.length) {
 912                         if (NT_STATUS_IS_OK(nt_status)) {
 913                                 nt_status = NT_STATUS_UNSUCCESSFUL;
 914                         }
 915                 } else if ((turn == 1) &&
 916                            NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 917                         DATA_BLOB tmp_blob = data_blob_null;
 918                         /* the server might give us back two challenges */
 919                         if (!spnego_parse_challenge(blob, &blob_in,
 920                                                     &tmp_blob)) {
 921                                 DEBUG(3,("Failed to parse challenges\n"));
 922                                 nt_status = NT_STATUS_INVALID_PARAMETER;
 923                         }
 924                         data_blob_free(&tmp_blob);
 925                 } else {
 926                         if (!spnego_parse_auth_response(blob, nt_status, OID_NTLMSSP,
 927                                                         &blob_in)) {
 928                                 DEBUG(3,("Failed to parse auth response\n"));
 929                                 if (NT_STATUS_IS_OK(nt_status)
 930                                     || NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED))
 931                                         nt_status = NT_STATUS_INVALID_PARAMETER;
 932                         }
 933                 }
 934                 data_blob_free(&blob);
 935                 data_blob_free(&blob_out);
 936                 turn++;
 937         } while (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED));
 938
 939         data_blob_free(&blob_in);
 940
 941         if (NT_STATUS_IS_OK(nt_status)) {
 942
 943                 if (cli->server_domain[0] == '\0') {
 944                         fstrcpy(cli->server_domain, ntlmssp_state->server_domain);
 945                 }
 946                 cli_set_session_key(cli, ntlmssp_state->session_key);
 947
 948                 if (cli_simple_set_signing(
 949                             cli, ntlmssp_state->session_key, data_blob_null)) {
 950
 951                         if (!cli_check_sign_mac(cli, cli->inbuf, 1)) {
 952                                 nt_status = NT_STATUS_ACCESS_DENIED;
 953                         }
 954                 }
 955         }
 956
 957         /* we have a reference conter on ntlmssp_state, if we are signing
 958            then the state will be kept by the signing engine */
 959
 960         ntlmssp_end(&ntlmssp_state);
 961
 962         if (!NT_STATUS_IS_OK(nt_status)) {
 963                 cli->vuid = 0;
 964         }
 965         return nt_status;
 966 }
 967
 968 /****************************************************************************
 969  Do a spnego encrypted session setup.
 970
 971  user_domain: The shortname of the domain the user/machine is a member of.
 972  dest_realm: The realm we're connecting to, if NULL we use our default realm.
 973 ****************************************************************************/
 974
 975 ADS_STATUS cli_session_setup_spnego(struct cli_state *cli, const char *user,
 976                               const char *pass, const char *user_domain,
 977                               const char * dest_realm)
 978 {
 979         char *principal = NULL;
 980         char *OIDs[ASN1_MAX_OIDS];
 981         int i;
 982         DATA_BLOB blob;
 983         const char *p = NULL;
 984         char *account = NULL;
 985         NTSTATUS status;
 986
 987         DEBUG(3,("Doing spnego session setup (blob length=%lu)\n", (unsigned long)cli->secblob.length));
 988
 989         /* the server might not even do spnego */
 990         if (cli->secblob.length <= 16) {
 991                 DEBUG(3,("server didn't supply a full spnego negprot\n"));
 992                 goto ntlmssp;
 993         }
 994
 995 #if 0
 996         file_save("negprot.dat", cli->secblob.data, cli->secblob.length);
 997 #endif
 998
 999         /* there is 16 bytes of GUID before the real spnego packet starts */
1000         blob = data_blob(cli->secblob.data+16, cli->secblob.length-16);
1001
1002         /* The server sent us the first part of the SPNEGO exchange in the
1003          * negprot reply. It is WRONG to depend on the principal sent in the
1004          * negprot reply, but right now we do it. If we don't receive one,
1005          * we try to best guess, then fall back to NTLM.  */
1006         if (!spnego_parse_negTokenInit(blob, OIDs, &principal)) {
1007                 data_blob_free(&blob);
1008                 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1009         }
1010         data_blob_free(&blob);
1011
1012         /* make sure the server understands kerberos */
1013         for (i=0;OIDs[i];i++) {
1014                 if (i == 0)
1015                         DEBUG(3,("got OID=%s\n", OIDs[i]));
1016                 else
1017                         DEBUGADD(3,("got OID=%s\n", OIDs[i]));
1018                 if (strcmp(OIDs[i], OID_KERBEROS5_OLD) == 0 ||
1019                     strcmp(OIDs[i], OID_KERBEROS5) == 0) {
1020                         cli->got_kerberos_mechanism = True;
1021                 }
1022                 talloc_free(OIDs[i]);
1023         }
1024
1025         DEBUG(3,("got principal=%s\n", principal ? principal : "<null>"));
1026
1027         status = cli_set_username(cli, user);
1028         if (!NT_STATUS_IS_OK(status)) {
1029                 return ADS_ERROR_NT(status);
1030         }
1031
1032 #ifdef HAVE_KRB5
1033         /* If password is set we reauthenticate to kerberos server
1034          * and do not store results */
1035
1036         if (cli->got_kerberos_mechanism && cli->use_kerberos) {
1037                 ADS_STATUS rc;
1038
1039                 if (pass && *pass) {
1040                         int ret;
1041
1042                         use_in_memory_ccache();
1043                         ret = kerberos_kinit_password(user, pass, 0 /* no time correction for now */, NULL);
1044
1045                         if (ret){
1046                                 TALLOC_FREE(principal);
1047                                 DEBUG(0, ("Kinit failed: %s\n", error_message(ret)));
1048                                 if (cli->fallback_after_kerberos)
1049                                         goto ntlmssp;
1050                                 return ADS_ERROR_KRB5(ret);
1051                         }
1052                 }
1053
1054                 /* If we get a bad principal, try to guess it if
1055                    we have a valid host NetBIOS name.
1056                  */
1057                 if (strequal(principal, ADS_IGNORE_PRINCIPAL)) {
1058                         TALLOC_FREE(principal);
1059                 }
1060
1061                 if (principal == NULL &&
1062                         !is_ipaddress(cli->desthost) &&
1063                         !strequal(STAR_SMBSERVER,
1064                                 cli->desthost)) {
1065                         char *realm = NULL;
1066                         char *machine = NULL;
1067                         char *host = NULL;
1068                         DEBUG(3,("cli_session_setup_spnego: got a "
1069                                 "bad server principal, trying to guess ...\n"));
1070
1071                         host = strchr_m(cli->desthost, '.');
1072                         if (host) {
1073                                 machine = SMB_STRNDUP(cli->desthost,
1074                                         host - cli->desthost);
1075                         } else {
1076                                 machine = SMB_STRDUP(cli->desthost);
1077                         }
1078                         if (machine == NULL) {
1079                                 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1080                         }
1081
1082                         if (dest_realm) {
1083                                 realm = SMB_STRDUP(dest_realm);
1084                                 strupper_m(realm);
1085                         } else {
1086                                 realm = kerberos_get_default_realm_from_ccache();
1087                         }
1088                         if (realm && *realm) {
1089                                 principal = talloc_asprintf(NULL, "%s$@%s",
1090                                                         machine, realm);
1091                                 if (!principal) {
1092                                         SAFE_FREE(machine);
1093                                         SAFE_FREE(realm);
1094                                         return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1095                                 }
1096                                 DEBUG(3,("cli_session_setup_spnego: guessed "
1097                                         "server principal=%s\n",
1098                                         principal ? principal : "<null>"));
1099                         }
1100                         SAFE_FREE(machine);
1101                         SAFE_FREE(realm);
1102                 }
1103
1104                 if (principal) {
1105                         rc = cli_session_setup_kerberos(cli, principal,
1106                                 dest_realm);
1107                         if (ADS_ERR_OK(rc) || !cli->fallback_after_kerberos) {
1108                                 TALLOC_FREE(principal);
1109                                 return rc;
1110                         }
1111                 }
1112         }
1113 #endif
1114
1115         TALLOC_FREE(principal);
1116
1117 ntlmssp:
1118
1119         account = talloc_strdup(talloc_tos(), user);
1120         if (!account) {
1121                 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1122         }
1123
1124         /* when falling back to ntlmssp while authenticating with a machine
1125          * account strip off the realm - gd */
1126
1127         if ((p = strchr_m(user, '@')) != NULL) {
1128                 account[PTR_DIFF(p,user)] = '\0';
1129         }
1130
1131         return ADS_ERROR_NT(cli_session_setup_ntlmssp(cli, account, pass, user_domain));
1132 }
1133
1134 /****************************************************************************
1135  Send a session setup. The username and workgroup is in UNIX character
1136  format and must be converted to DOS codepage format before sending. If the
1137  password is in plaintext, the same should be done.
1138 ****************************************************************************/
1139
1140 NTSTATUS cli_session_setup(struct cli_state *cli,
1141                            const char *user,
1142                            const char *pass, int passlen,
1143                            const char *ntpass, int ntpasslen,
1144                            const char *workgroup)
1145 {
1146         char *p;
1147         fstring user2;
1148
1149         if (user) {
1150                 fstrcpy(user2, user);
1151         } else {
1152                 user2[0] ='\0';
1153         }
1154
1155         if (!workgroup) {
1156                 workgroup = "";
1157         }
1158
1159         /* allow for workgroups as part of the username */
1160         if ((p=strchr_m(user2,'\\')) || (p=strchr_m(user2,'/')) ||
1161             (p=strchr_m(user2,*lp_winbind_separator()))) {
1162                 *p = 0;
1163                 user = p+1;
1164                 workgroup = user2;
1165         }
1166
1167         if (cli->protocol < PROTOCOL_LANMAN1) {
1168                 return NT_STATUS_OK;
1169         }
1170
1171         /* now work out what sort of session setup we are going to
1172            do. I have split this into separate functions to make the
1173            flow a bit easier to understand (tridge) */
1174
1175         /* if its an older server then we have to use the older request format */
1176
1177         if (cli->protocol < PROTOCOL_NT1) {
1178                 if (!lp_client_lanman_auth() && passlen != 24 && (*pass)) {
1179                         DEBUG(1, ("Server requested LM password but 'client lanman auth'"
1180                                   " is disabled\n"));
1181                         return NT_STATUS_ACCESS_DENIED;
1182                 }
1183
1184                 if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0 &&
1185                     !lp_client_plaintext_auth() && (*pass)) {
1186                         DEBUG(1, ("Server requested plaintext password but "
1187                                   "'client plaintext auth' is disabled\n"));
1188                         return NT_STATUS_ACCESS_DENIED;
1189                 }
1190
1191                 return cli_session_setup_lanman2(cli, user, pass, passlen,
1192                                                  workgroup);
1193         }
1194
1195         /* if no user is supplied then we have to do an anonymous connection.
1196            passwords are ignored */
1197
1198         if (!user || !*user)
1199                 return cli_session_setup_guest(cli);
1200
1201         /* if the server is share level then send a plaintext null
1202            password at this point. The password is sent in the tree
1203            connect */
1204
1205         if ((cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) == 0)
1206                 return cli_session_setup_plaintext(cli, user, "", workgroup);
1207
1208         /* if the server doesn't support encryption then we have to use
1209            plaintext. The second password is ignored */
1210
1211         if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0) {
1212                 if (!lp_client_plaintext_auth() && (*pass)) {
1213                         DEBUG(1, ("Server requested plaintext password but "
1214                                   "'client plaintext auth' is disabled\n"));
1215                         return NT_STATUS_ACCESS_DENIED;
1216                 }
1217                 return cli_session_setup_plaintext(cli, user, pass, workgroup);
1218         }
1219
1220         /* if the server supports extended security then use SPNEGO */
1221
1222         if (cli->capabilities & CAP_EXTENDED_SECURITY) {
1223                 ADS_STATUS status = cli_session_setup_spnego(cli, user, pass,
1224                                                              workgroup, NULL);
1225                 if (!ADS_ERR_OK(status)) {
1226                         DEBUG(3, ("SPNEGO login failed: %s\n", ads_errstr(status)));
1227                         return ads_ntstatus(status);
1228                 }
1229         } else {
1230                 NTSTATUS status;
1231
1232                 /* otherwise do a NT1 style session setup */
1233                 status = cli_session_setup_nt1(cli, user, pass, passlen,
1234                                                ntpass, ntpasslen, workgroup);
1235                 if (!NT_STATUS_IS_OK(status)) {
1236                         DEBUG(3,("cli_session_setup: NT1 session setup "
1237                                  "failed: %s\n", nt_errstr(status)));
1238                         return status;
1239                 }
1240         }
1241
1242         if (strstr(cli->server_type, "Samba")) {
1243                 cli->is_samba = True;
1244         }
1245
1246         return NT_STATUS_OK;
1247 }
1248
1249 /****************************************************************************
1250  Send a uloggoff.
1251 *****************************************************************************/
1252
1253 bool cli_ulogoff(struct cli_state *cli)
1254 {
1255         memset(cli->outbuf,'\0',smb_size);
1256         cli_set_message(cli->outbuf,2,0,True);
1257         SCVAL(cli->outbuf,smb_com,SMBulogoffX);
1258         cli_setup_packet(cli);
1259         SSVAL(cli->outbuf,smb_vwv0,0xFF);
1260         SSVAL(cli->outbuf,smb_vwv2,0);  /* no additional info */
1261
1262         cli_send_smb(cli);
1263         if (!cli_receive_smb(cli))
1264                 return False;
1265
1266         if (cli_is_error(cli)) {
1267                 return False;
1268         }
1269
1270         cli->vuid = -1;
1271         return True;
1272 }
1273
1274 /****************************************************************************
1275  Send a tconX.
1276 ****************************************************************************/
1277
1278 struct cli_tcon_andx_state {
1279         struct cli_state *cli;
1280         uint16_t vwv[4];
1281         struct iovec bytes;
1282 };
1283
1284 static void cli_tcon_andx_done(struct tevent_req *subreq);
1285
1286 struct tevent_req *cli_tcon_andx_create(TALLOC_CTX *mem_ctx,
1287                                         struct event_context *ev,
1288                                         struct cli_state *cli,
1289                                         const char *share, const char *dev,
1290                                         const char *pass, int passlen,
1291                                         struct tevent_req **psmbreq)
1292 {
1293         struct tevent_req *req, *subreq;
1294         struct cli_tcon_andx_state *state;
1295         fstring pword;
1296         uint16_t *vwv;
1297         char *tmp = NULL;
1298         uint8_t *bytes;
1299
1300         req = tevent_req_create(mem_ctx, &state, struct cli_tcon_andx_state);
1301         if (req == NULL) {
1302                 return NULL;
1303         }
1304         state->cli = cli;
1305         vwv = state->vwv;
1306
1307         fstrcpy(cli->share, share);
1308
1309         /* in user level security don't send a password now */
1310         if (cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) {
1311                 passlen = 1;
1312                 pass = "";
1313         } else if (pass == NULL) {
1314                 DEBUG(1, ("Server not using user level security and no "
1315                           "password supplied.\n"));
1316                 goto access_denied;
1317         }
1318
1319         if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) &&
1320             *pass && passlen != 24) {
1321                 if (!lp_client_lanman_auth()) {
1322                         DEBUG(1, ("Server requested LANMAN password "
1323                                   "(share-level security) but "
1324                                   "'client lanman auth' is disabled\n"));
1325                         goto access_denied;
1326                 }
1327
1328                 /*
1329                  * Non-encrypted passwords - convert to DOS codepage before
1330                  * encryption.
1331                  */
1332                 passlen = 24;
1333                 SMBencrypt(pass, cli->secblob.data, (uchar *)pword);
1334         } else {
1335                 if((cli->sec_mode & (NEGOTIATE_SECURITY_USER_LEVEL
1336                                      |NEGOTIATE_SECURITY_CHALLENGE_RESPONSE))
1337                    == 0) {
1338                         if (!lp_client_plaintext_auth() && (*pass)) {
1339                                 DEBUG(1, ("Server requested plaintext "
1340                                           "password but 'client plaintext "
1341                                           "auth' is disabled\n"));
1342                                 goto access_denied;
1343                         }
1344
1345                         /*
1346                          * Non-encrypted passwords - convert to DOS codepage
1347                          * before using.
1348                          */
1349                         passlen = clistr_push(cli, pword, pass, sizeof(pword),
1350                                               STR_TERMINATE);
1351                         if (passlen == -1) {
1352                                 DEBUG(1, ("clistr_push(pword) failed\n"));
1353                                 goto access_denied;
1354                         }
1355                 } else {
1356                         if (passlen) {
1357                                 memcpy(pword, pass, passlen);
1358                         }
1359                 }
1360         }
1361
1362         SCVAL(vwv+0, 0, 0xFF);
1363         SCVAL(vwv+0, 1, 0);
1364         SSVAL(vwv+1, 0, 0);
1365         SSVAL(vwv+2, 0, TCONX_FLAG_EXTENDED_RESPONSE);
1366         SSVAL(vwv+3, 0, passlen);
1367
1368         if (passlen) {
1369                 bytes = (uint8_t *)talloc_memdup(state, pword, passlen);
1370         } else {
1371                 bytes = talloc_array(state, uint8_t, 0);
1372         }
1373
1374         /*
1375          * Add the sharename
1376          */
1377         tmp = talloc_asprintf_strupper_m(talloc_tos(), "\\\\%s\\%s",
1378                                          cli->desthost, share);
1379         if (tmp == NULL) {
1380                 TALLOC_FREE(req);
1381                 return NULL;
1382         }
1383         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), tmp, strlen(tmp)+1,
1384                                    NULL);
1385         TALLOC_FREE(tmp);
1386
1387         /*
1388          * Add the devicetype
1389          */
1390         tmp = talloc_strdup_upper(talloc_tos(), dev);
1391         if (tmp == NULL) {
1392                 TALLOC_FREE(req);
1393                 return NULL;
1394         }
1395         bytes = smb_bytes_push_str(bytes, false, tmp, strlen(tmp)+1, NULL);
1396         TALLOC_FREE(tmp);
1397
1398         if (bytes == NULL) {
1399                 TALLOC_FREE(req);
1400                 return NULL;
1401         }
1402
1403         state->bytes.iov_base = (void *)bytes;
1404         state->bytes.iov_len = talloc_get_size(bytes);
1405
1406         subreq = cli_smb_req_create(state, ev, cli, SMBtconX, 0, 4, vwv,
1407                                     1, &state->bytes);
1408         if (subreq == NULL) {
1409                 TALLOC_FREE(req);
1410                 return NULL;
1411         }
1412         tevent_req_set_callback(subreq, cli_tcon_andx_done, req);
1413         *psmbreq = subreq;
1414         return req;
1415
1416  access_denied:
1417         tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1418         return tevent_req_post(req, ev);
1419 }
1420
1421 struct tevent_req *cli_tcon_andx_send(TALLOC_CTX *mem_ctx,
1422                                       struct event_context *ev,
1423                                       struct cli_state *cli,
1424                                       const char *share, const char *dev,
1425                                       const char *pass, int passlen)
1426 {
1427         struct tevent_req *req, *subreq;
1428         NTSTATUS status;
1429
1430         req = cli_tcon_andx_create(mem_ctx, ev, cli, share, dev, pass, passlen,
1431                                    &subreq);
1432         if (req == NULL) {
1433                 return NULL;
1434         }
1435         status = cli_smb_req_send(subreq);
1436         if (!NT_STATUS_IS_OK(status)) {
1437                 tevent_req_nterror(req, status);
1438                 return tevent_req_post(req, ev);
1439         }
1440         return req;
1441 }
1442
1443 static void cli_tcon_andx_done(struct tevent_req *subreq)
1444 {
1445         struct tevent_req *req = tevent_req_callback_data(
1446                 subreq, struct tevent_req);
1447         struct cli_tcon_andx_state *state = tevent_req_data(
1448                 req, struct cli_tcon_andx_state);
1449         struct cli_state *cli = state->cli;
1450         char *inbuf = (char *)cli_smb_inbuf(subreq);
1451         uint8_t wct;
1452         uint16_t *vwv;
1453         uint32_t num_bytes;
1454         uint8_t *bytes;
1455         NTSTATUS status;
1456
1457         status = cli_smb_recv(subreq, 0, &wct, &vwv, &num_bytes, &bytes);
1458         if (!NT_STATUS_IS_OK(status)) {
1459                 TALLOC_FREE(subreq);
1460                 tevent_req_nterror(req, status);
1461                 return;
1462         }
1463
1464         clistr_pull(inbuf, cli->dev, bytes, sizeof(fstring), num_bytes,
1465                     STR_TERMINATE|STR_ASCII);
1466
1467         if ((cli->protocol >= PROTOCOL_NT1) && (num_bytes == 3)) {
1468                 /* almost certainly win95 - enable bug fixes */
1469                 cli->win95 = True;
1470         }
1471
1472         /*
1473          * Make sure that we have the optional support 16-bit field. WCT > 2.
1474          * Avoids issues when connecting to Win9x boxes sharing files
1475          */
1476
1477         cli->dfsroot = false;
1478
1479         if ((wct > 2) && (cli->protocol >= PROTOCOL_LANMAN2)) {
1480                 cli->dfsroot = ((SVAL(vwv+2, 0) & SMB_SHARE_IN_DFS) != 0);
1481         }
1482
1483         cli->cnum = SVAL(inbuf,smb_tid);
1484         tevent_req_done(req);
1485 }
1486
1487 NTSTATUS cli_tcon_andx_recv(struct tevent_req *req)
1488 {
1489         return tevent_req_simple_recv_ntstatus(req);
1490 }
1491
1492 NTSTATUS cli_tcon_andx(struct cli_state *cli, const char *share,
1493                        const char *dev, const char *pass, int passlen)
1494 {
1495         TALLOC_CTX *frame = talloc_stackframe();
1496         struct event_context *ev;
1497         struct tevent_req *req;
1498         NTSTATUS status = NT_STATUS_OK;
1499
1500         if (cli_has_async_calls(cli)) {
1501                 /*
1502                  * Can't use sync call while an async call is in flight
1503                  */
1504                 status = NT_STATUS_INVALID_PARAMETER;
1505                 goto fail;
1506         }
1507
1508         ev = event_context_init(frame);
1509         if (ev == NULL) {
1510                 status = NT_STATUS_NO_MEMORY;
1511                 goto fail;
1512         }
1513
1514         req = cli_tcon_andx_send(frame, ev, cli, share, dev, pass, passlen);
1515         if (req == NULL) {
1516                 status = NT_STATUS_NO_MEMORY;
1517                 goto fail;
1518         }
1519
1520         if (!tevent_req_poll(req, ev)) {
1521                 status = map_nt_error_from_unix(errno);
1522                 goto fail;
1523         }
1524
1525         status = cli_tcon_andx_recv(req);
1526  fail:
1527         TALLOC_FREE(frame);
1528         if (!NT_STATUS_IS_OK(status)) {
1529                 cli_set_error(cli, status);
1530         }
1531         return status;
1532 }
1533
1534 /****************************************************************************
1535  Send a tree disconnect.
1536 ****************************************************************************/
1537
1538 bool cli_tdis(struct cli_state *cli)
1539 {
1540         memset(cli->outbuf,'\0',smb_size);
1541         cli_set_message(cli->outbuf,0,0,True);
1542         SCVAL(cli->outbuf,smb_com,SMBtdis);
1543         SSVAL(cli->outbuf,smb_tid,cli->cnum);
1544         cli_setup_packet(cli);
1545
1546         cli_send_smb(cli);
1547         if (!cli_receive_smb(cli))
1548                 return False;
1549
1550         if (cli_is_error(cli)) {
1551                 return False;
1552         }
1553
1554         cli->cnum = -1;
1555         return True;
1556 }
1557
1558 /****************************************************************************
1559  Send a negprot command.
1560 ****************************************************************************/
1561
1562 void cli_negprot_sendsync(struct cli_state *cli)
1563 {
1564         char *p;
1565         int numprots;
1566
1567         if (cli->protocol < PROTOCOL_NT1)
1568                 cli->use_spnego = False;
1569
1570         memset(cli->outbuf,'\0',smb_size);
1571
1572         /* setup the protocol strings */
1573         cli_set_message(cli->outbuf,0,0,True);
1574
1575         p = smb_buf(cli->outbuf);
1576         for (numprots=0; numprots < ARRAY_SIZE(prots); numprots++) {
1577                 if (prots[numprots].prot > cli->protocol) {
1578                         break;
1579                 }
1580                 *p++ = 2;
1581                 p += clistr_push(cli, p, prots[numprots].name, -1, STR_TERMINATE);
1582         }
1583
1584         SCVAL(cli->outbuf,smb_com,SMBnegprot);
1585         cli_setup_bcc(cli, p);
1586         cli_setup_packet(cli);
1587
1588         SCVAL(smb_buf(cli->outbuf),0,2);
1589
1590         cli_send_smb(cli);
1591 }
1592
1593 /****************************************************************************
1594  Send a negprot command.
1595 ****************************************************************************/
1596
1597 struct cli_negprot_state {
1598         struct cli_state *cli;
1599 };
1600
1601 static void cli_negprot_done(struct tevent_req *subreq);
1602
1603 struct tevent_req *cli_negprot_send(TALLOC_CTX *mem_ctx,
1604                                     struct event_context *ev,
1605                                     struct cli_state *cli)
1606 {
1607         struct tevent_req *req, *subreq;
1608         struct cli_negprot_state *state;
1609         uint8_t *bytes = NULL;
1610         int numprots;
1611         uint16_t cnum;
1612
1613         req = tevent_req_create(mem_ctx, &state, struct cli_negprot_state);
1614         if (req == NULL) {
1615                 return NULL;
1616         }
1617         state->cli = cli;
1618
1619         if (cli->protocol < PROTOCOL_NT1)
1620                 cli->use_spnego = False;
1621
1622         /* setup the protocol strings */
1623         for (numprots=0; numprots < ARRAY_SIZE(prots); numprots++) {
1624                 uint8_t c = 2;
1625                 if (prots[numprots].prot > cli->protocol) {
1626                         break;
1627                 }
1628                 bytes = (uint8_t *)talloc_append_blob(
1629                         state, bytes, data_blob_const(&c, sizeof(c)));
1630                 if (tevent_req_nomem(bytes, req)) {
1631                         return tevent_req_post(req, ev);
1632                 }
1633                 bytes = smb_bytes_push_str(bytes, false,
1634                                            prots[numprots].name,
1635                                            strlen(prots[numprots].name)+1,
1636                                            NULL);
1637                 if (tevent_req_nomem(bytes, req)) {
1638                         return tevent_req_post(req, ev);
1639                 }
1640         }
1641
1642         cnum = cli->cnum;
1643
1644         cli->cnum = 0;
1645         subreq = cli_smb_send(state, ev, cli, SMBnegprot, 0, 0, NULL,
1646                               talloc_get_size(bytes), bytes);
1647         cli->cnum = cnum;
1648
1649         if (tevent_req_nomem(subreq, req)) {
1650                 return tevent_req_post(req, ev);
1651         }
1652         tevent_req_set_callback(subreq, cli_negprot_done, req);
1653         return req;
1654 }
1655
1656 static void cli_negprot_done(struct tevent_req *subreq)
1657 {
1658         struct tevent_req *req = tevent_req_callback_data(
1659                 subreq, struct tevent_req);
1660         struct cli_negprot_state *state = tevent_req_data(
1661                 req, struct cli_negprot_state);
1662         struct cli_state *cli = state->cli;
1663         uint8_t wct;
1664         uint16_t *vwv;
1665         uint32_t num_bytes;
1666         uint8_t *bytes;
1667         NTSTATUS status;
1668         uint16_t protnum;
1669
1670         status = cli_smb_recv(subreq, 1, &wct, &vwv, &num_bytes, &bytes);
1671         if (!NT_STATUS_IS_OK(status)) {
1672                 TALLOC_FREE(subreq);
1673                 return;
1674         }
1675
1676         protnum = SVAL(vwv, 0);
1677
1678         if ((protnum >= ARRAY_SIZE(prots))
1679             || (prots[protnum].prot > cli->protocol)) {
1680                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1681                 return;
1682         }
1683
1684         cli->protocol = prots[protnum].prot;
1685
1686         if ((cli->protocol < PROTOCOL_NT1) &&
1687             client_is_signing_mandatory(cli)) {
1688                 DEBUG(0,("cli_negprot: SMB signing is mandatory and the selected protocol level doesn't support it.\n"));
1689                 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1690                 return;
1691         }
1692
1693         if (cli->protocol >= PROTOCOL_NT1) {
1694                 struct timespec ts;
1695                 bool negotiated_smb_signing = false;
1696
1697                 /* NT protocol */
1698                 cli->sec_mode = CVAL(vwv + 1, 0);
1699                 cli->max_mux = SVAL(vwv + 1, 1);
1700                 cli->max_xmit = IVAL(vwv + 3, 1);
1701                 cli->sesskey = IVAL(vwv + 7, 1);
1702                 cli->serverzone = SVALS(vwv + 15, 1);
1703                 cli->serverzone *= 60;
1704                 /* this time arrives in real GMT */
1705                 ts = interpret_long_date(((char *)(vwv+11))+1);
1706                 cli->servertime = ts.tv_sec;
1707                 cli->secblob = data_blob(bytes, num_bytes);
1708                 cli->capabilities = IVAL(vwv + 9, 1);
1709                 if (cli->capabilities & CAP_RAW_MODE) {
1710                         cli->readbraw_supported = True;
1711                         cli->writebraw_supported = True;
1712                 }
1713                 /* work out if they sent us a workgroup */
1714                 if (!(cli->capabilities & CAP_EXTENDED_SECURITY) &&
1715                     smb_buflen(cli->inbuf) > 8) {
1716                         clistr_pull(cli->inbuf, cli->server_domain,
1717                                     bytes+8, sizeof(cli->server_domain),
1718                                     num_bytes-8,
1719                                     STR_UNICODE|STR_NOALIGN);
1720                 }
1721
1722                 /*
1723                  * As signing is slow we only turn it on if either the client or
1724                  * the server require it. JRA.
1725                  */
1726
1727                 if (cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED) {
1728                         /* Fail if server says signing is mandatory and we don't want to support it. */
1729                         if (!client_is_signing_allowed(cli)) {
1730                                 DEBUG(0,("cli_negprot: SMB signing is mandatory and we have disabled it.\n"));
1731                                 tevent_req_nterror(req,
1732                                                    NT_STATUS_ACCESS_DENIED);
1733                                 return;
1734                         }
1735                         negotiated_smb_signing = true;
1736                 } else if (client_is_signing_mandatory(cli) && client_is_signing_allowed(cli)) {
1737                         /* Fail if client says signing is mandatory and the server doesn't support it. */
1738                         if (!(cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED)) {
1739                                 DEBUG(1,("cli_negprot: SMB signing is mandatory and the server doesn't support it.\n"));
1740                                 tevent_req_nterror(req,
1741                                                    NT_STATUS_ACCESS_DENIED);
1742                                 return;
1743                         }
1744                         negotiated_smb_signing = true;
1745                 } else if (cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED) {
1746                         negotiated_smb_signing = true;
1747                 }
1748
1749                 if (negotiated_smb_signing) {
1750                         cli_set_signing_negotiated(cli);
1751                 }
1752
1753                 if (cli->capabilities & (CAP_LARGE_READX|CAP_LARGE_WRITEX)) {
1754                         SAFE_FREE(cli->outbuf);
1755                         SAFE_FREE(cli->inbuf);
1756                         cli->outbuf = (char *)SMB_MALLOC(CLI_SAMBA_MAX_LARGE_READX_SIZE+LARGE_WRITEX_HDR_SIZE+SAFETY_MARGIN);
1757                         cli->inbuf = (char *)SMB_MALLOC(CLI_SAMBA_MAX_LARGE_READX_SIZE+LARGE_WRITEX_HDR_SIZE+SAFETY_MARGIN);
1758                         cli->bufsize = CLI_SAMBA_MAX_LARGE_READX_SIZE + LARGE_WRITEX_HDR_SIZE;
1759                 }
1760
1761         } else if (cli->protocol >= PROTOCOL_LANMAN1) {
1762                 cli->use_spnego = False;
1763                 cli->sec_mode = SVAL(vwv + 1, 0);
1764                 cli->max_xmit = SVAL(vwv + 2, 0);
1765                 cli->max_mux = SVAL(vwv + 3, 0);
1766                 cli->sesskey = IVAL(vwv + 6, 0);
1767                 cli->serverzone = SVALS(vwv + 10, 0);
1768                 cli->serverzone *= 60;
1769                 /* this time is converted to GMT by make_unix_date */
1770                 cli->servertime = cli_make_unix_date(
1771                         cli, (char *)(vwv + 8));
1772                 cli->readbraw_supported = ((SVAL(vwv + 5, 0) & 0x1) != 0);
1773                 cli->writebraw_supported = ((SVAL(vwv + 5, 0) & 0x2) != 0);
1774                 cli->secblob = data_blob(bytes, num_bytes);
1775         } else {
1776                 /* the old core protocol */
1777                 cli->use_spnego = False;
1778                 cli->sec_mode = 0;
1779                 cli->serverzone = get_time_zone(time(NULL));
1780         }
1781
1782         cli->max_xmit = MIN(cli->max_xmit, CLI_BUFFER_SIZE);
1783
1784         /* a way to force ascii SMB */
1785         if (getenv("CLI_FORCE_ASCII"))
1786                 cli->capabilities &= ~CAP_UNICODE;
1787
1788         tevent_req_done(req);
1789 }
1790
1791 NTSTATUS cli_negprot_recv(struct tevent_req *req)
1792 {
1793         return tevent_req_simple_recv_ntstatus(req);
1794 }
1795
1796 NTSTATUS cli_negprot(struct cli_state *cli)
1797 {
1798         TALLOC_CTX *frame = talloc_stackframe();
1799         struct event_context *ev;
1800         struct tevent_req *req;
1801         NTSTATUS status = NT_STATUS_OK;
1802
1803         if (cli_has_async_calls(cli)) {
1804                 /*
1805                  * Can't use sync call while an async call is in flight
1806                  */
1807                 status = NT_STATUS_INVALID_PARAMETER;
1808                 goto fail;
1809         }
1810
1811         ev = event_context_init(frame);
1812         if (ev == NULL) {
1813                 status = NT_STATUS_NO_MEMORY;
1814                 goto fail;
1815         }
1816
1817         req = cli_negprot_send(frame, ev, cli);
1818         if (req == NULL) {
1819                 status = NT_STATUS_NO_MEMORY;
1820                 goto fail;
1821         }
1822
1823         if (!tevent_req_poll(req, ev)) {
1824                 status = map_nt_error_from_unix(errno);
1825                 goto fail;
1826         }
1827
1828         status = cli_negprot_recv(req);
1829  fail:
1830         TALLOC_FREE(frame);
1831         if (!NT_STATUS_IS_OK(status)) {
1832                 cli_set_error(cli, status);
1833         }
1834         return status;
1835 }
1836
1837 /****************************************************************************
1838  Send a session request. See rfc1002.txt 4.3 and 4.3.2.
1839 ****************************************************************************/
1840
1841 bool cli_session_request(struct cli_state *cli,
1842                          struct nmb_name *calling, struct nmb_name *called)
1843 {
1844         char *p;
1845         int len = 4;
1846         char *tmp;
1847
1848         /* 445 doesn't have session request */
1849         if (cli->port == 445)
1850                 return True;
1851
1852         memcpy(&(cli->calling), calling, sizeof(*calling));
1853         memcpy(&(cli->called ), called , sizeof(*called ));
1854
1855         /* put in the destination name */
1856
1857         tmp = name_mangle(talloc_tos(), cli->called.name,
1858                           cli->called.name_type);
1859         if (tmp == NULL) {
1860                 return false;
1861         }
1862
1863         p = cli->outbuf+len;
1864         memcpy(p, tmp, name_len(tmp));
1865         len += name_len(tmp);
1866         TALLOC_FREE(tmp);
1867
1868         /* and my name */
1869
1870         tmp = name_mangle(talloc_tos(), cli->calling.name,
1871                           cli->calling.name_type);
1872         if (tmp == NULL) {
1873                 return false;
1874         }
1875
1876         p = cli->outbuf+len;
1877         memcpy(p, tmp, name_len(tmp));
1878         len += name_len(tmp);
1879         TALLOC_FREE(tmp);
1880
1881         /* send a session request (RFC 1002) */
1882         /* setup the packet length
1883          * Remove four bytes from the length count, since the length
1884          * field in the NBT Session Service header counts the number
1885          * of bytes which follow.  The cli_send_smb() function knows
1886          * about this and accounts for those four bytes.
1887          * CRH.
1888          */
1889         len -= 4;
1890         _smb_setlen(cli->outbuf,len);
1891         SCVAL(cli->outbuf,0,0x81);
1892
1893         cli_send_smb(cli);
1894         DEBUG(5,("Sent session request\n"));
1895
1896         if (!cli_receive_smb(cli))
1897                 return False;
1898
1899         if (CVAL(cli->inbuf,0) == 0x84) {
1900                 /* C. Hoch  9/14/95 Start */
1901                 /* For information, here is the response structure.
1902                  * We do the byte-twiddling to for portability.
1903                 struct RetargetResponse{
1904                 unsigned char type;
1905                 unsigned char flags;
1906                 int16 length;
1907                 int32 ip_addr;
1908                 int16 port;
1909                 };
1910                 */
1911                 uint16_t port = (CVAL(cli->inbuf,8)<<8)+CVAL(cli->inbuf,9);
1912                 struct in_addr dest_ip;
1913                 NTSTATUS status;
1914
1915                 /* SESSION RETARGET */
1916                 putip((char *)&dest_ip,cli->inbuf+4);
1917                 in_addr_to_sockaddr_storage(&cli->dest_ss, dest_ip);
1918
1919                 status = open_socket_out(&cli->dest_ss, port,
1920                                          LONG_CONNECT_TIMEOUT, &cli->fd);
1921                 if (!NT_STATUS_IS_OK(status)) {
1922                         return False;
1923                 }
1924
1925                 DEBUG(3,("Retargeted\n"));
1926
1927                 set_socket_options(cli->fd, lp_socket_options());
1928
1929                 /* Try again */
1930                 {
1931                         static int depth;
1932                         bool ret;
1933                         if (depth > 4) {
1934                                 DEBUG(0,("Retarget recursion - failing\n"));
1935                                 return False;
1936                         }
1937                         depth++;
1938                         ret = cli_session_request(cli, calling, called);
1939                         depth--;
1940                         return ret;
1941                 }
1942         } /* C. Hoch 9/14/95 End */
1943
1944         if (CVAL(cli->inbuf,0) != 0x82) {
1945                 /* This is the wrong place to put the error... JRA. */
1946                 cli->rap_error = CVAL(cli->inbuf,4);
1947                 return False;
1948         }
1949         return(True);
1950 }
1951
1952 struct fd_struct {
1953         int fd;
1954 };
1955
1956 static void smb_sock_connected(struct tevent_req *req)
1957 {
1958         struct fd_struct *pfd = tevent_req_callback_data(
1959                 req, struct fd_struct);
1960         int fd;
1961         NTSTATUS status;
1962
1963         status = open_socket_out_defer_recv(req, &fd);
1964         if (NT_STATUS_IS_OK(status)) {
1965                 pfd->fd = fd;
1966         }
1967 }
1968
1969 static NTSTATUS open_smb_socket(const struct sockaddr_storage *pss,
1970                                 uint16_t *port, int timeout, int *pfd)
1971 {
1972         struct event_context *ev;
1973         struct tevent_req *r139, *r445;
1974         struct fd_struct *fd139, *fd445;
1975         NTSTATUS status = NT_STATUS_NO_MEMORY;
1976
1977         if (*port != 0) {
1978                 return open_socket_out(pss, *port, timeout, pfd);
1979         }
1980
1981         ev = event_context_init(talloc_tos());
1982         if (ev == NULL) {
1983                 return NT_STATUS_NO_MEMORY;
1984         }
1985
1986         fd139 = talloc(ev, struct fd_struct);
1987         if (fd139 == NULL) {
1988                 goto done;
1989         }
1990         fd139->fd = -1;
1991
1992         fd445 = talloc(ev, struct fd_struct);
1993         if (fd445 == NULL) {
1994                 goto done;
1995         }
1996         fd445->fd = -1;
1997
1998         r445 = open_socket_out_defer_send(ev, ev, timeval_set(0, 0),
1999                                           pss, 445, timeout);
2000         r139 = open_socket_out_defer_send(ev, ev, timeval_set(0, 3000),
2001                                           pss, 139, timeout);
2002         if ((r445 == NULL) || (r139 == NULL)) {
2003                 goto done;
2004         }
2005         tevent_req_set_callback(r445, smb_sock_connected, fd445);
2006         tevent_req_set_callback(r139, smb_sock_connected, fd139);
2007
2008         while ((fd445->fd == -1) && (fd139->fd == -1)
2009                && (tevent_req_is_in_progress(r139)
2010                    || tevent_req_is_in_progress(r445))) {
2011                 event_loop_once(ev);
2012         }
2013
2014         if ((fd139->fd != -1) && (fd445->fd != -1)) {
2015                 close(fd139->fd);
2016                 fd139->fd = -1;
2017         }
2018
2019         if (fd445->fd != -1) {
2020                 *port = 445;
2021                 *pfd = fd445->fd;
2022                 status = NT_STATUS_OK;
2023                 goto done;
2024         }
2025         if (fd139->fd != -1) {
2026                 *port = 139;
2027                 *pfd = fd139->fd;
2028                 status = NT_STATUS_OK;
2029                 goto done;
2030         }
2031
2032         status = open_socket_out_defer_recv(r445, &fd445->fd);
2033  done:
2034         TALLOC_FREE(ev);
2035         return status;
2036 }
2037
2038 /****************************************************************************
2039  Open the client sockets.
2040 ****************************************************************************/
2041
2042 NTSTATUS cli_connect(struct cli_state *cli,
2043                 const char *host,
2044                 struct sockaddr_storage *dest_ss)
2045
2046 {
2047         int name_type = 0x20;
2048         TALLOC_CTX *frame = talloc_stackframe();
2049         unsigned int num_addrs = 0;
2050         unsigned int i = 0;
2051         struct sockaddr_storage *ss_arr = NULL;
2052         char *p = NULL;
2053
2054         /* reasonable default hostname */
2055         if (!host) {
2056                 host = STAR_SMBSERVER;
2057         }
2058
2059         fstrcpy(cli->desthost, host);
2060
2061         /* allow hostnames of the form NAME#xx and do a netbios lookup */
2062         if ((p = strchr(cli->desthost, '#'))) {
2063                 name_type = strtol(p+1, NULL, 16);
2064                 *p = 0;
2065         }
2066
2067         if (!dest_ss || is_zero_addr((struct sockaddr *)dest_ss)) {
2068                 NTSTATUS status =resolve_name_list(frame,
2069                                         cli->desthost,
2070                                         name_type,
2071                                         &ss_arr,
2072                                         &num_addrs);
2073                 if (!NT_STATUS_IS_OK(status)) {
2074                         TALLOC_FREE(frame);
2075                         return NT_STATUS_BAD_NETWORK_NAME;
2076                 }
2077         } else {
2078                 num_addrs = 1;
2079                 ss_arr = TALLOC_P(frame, struct sockaddr_storage);
2080                 if (!ss_arr) {
2081                         TALLOC_FREE(frame);
2082                         return NT_STATUS_NO_MEMORY;
2083                 }
2084                 *ss_arr = *dest_ss;
2085         }
2086
2087         for (i = 0; i < num_addrs; i++) {
2088                 cli->dest_ss = ss_arr[i];
2089                 if (getenv("LIBSMB_PROG")) {
2090                         cli->fd = sock_exec(getenv("LIBSMB_PROG"));
2091                 } else {
2092                         uint16_t port = cli->port;
2093                         NTSTATUS status;
2094                         status = open_smb_socket(&cli->dest_ss, &port,
2095                                                  cli->timeout, &cli->fd);
2096                         if (NT_STATUS_IS_OK(status)) {
2097                                 cli->port = port;
2098                         }
2099                 }
2100                 if (cli->fd == -1) {
2101                         char addr[INET6_ADDRSTRLEN];
2102                         print_sockaddr(addr, sizeof(addr), &ss_arr[i]);
2103                         DEBUG(2,("Error connecting to %s (%s)\n",
2104                                  dest_ss?addr:host,strerror(errno)));
2105                 } else {
2106                         /* Exit from loop on first connection. */
2107                         break;
2108                 }
2109         }
2110
2111         if (cli->fd == -1) {
2112                 TALLOC_FREE(frame);
2113                 return map_nt_error_from_unix(errno);
2114         }
2115
2116         if (dest_ss) {
2117                 *dest_ss = cli->dest_ss;
2118         }
2119
2120         set_socket_options(cli->fd, lp_socket_options());
2121
2122         TALLOC_FREE(frame);
2123         return NT_STATUS_OK;
2124 }
2125
2126 /**
2127    establishes a connection to after the negprot.
2128    @param output_cli A fully initialised cli structure, non-null only on success
2129    @param dest_host The netbios name of the remote host
2130    @param dest_ss (optional) The the destination IP, NULL for name based lookup
2131    @param port (optional) The destination port (0 for default)
2132    @param retry bool. Did this connection fail with a retryable error ?
2133
2134 */
2135 NTSTATUS cli_start_connection(struct cli_state **output_cli,
2136                               const char *my_name,
2137                               const char *dest_host,
2138                               struct sockaddr_storage *dest_ss, int port,
2139                               int signing_state, int flags,
2140                               bool *retry)
2141 {
2142         NTSTATUS nt_status;
2143         struct nmb_name calling;
2144         struct nmb_name called;
2145         struct cli_state *cli;
2146         struct sockaddr_storage ss;
2147
2148         if (retry)
2149                 *retry = False;
2150
2151         if (!my_name)
2152                 my_name = global_myname();
2153
2154         if (!(cli = cli_initialise_ex(signing_state))) {
2155                 return NT_STATUS_NO_MEMORY;
2156         }
2157
2158         make_nmb_name(&calling, my_name, 0x0);
2159         make_nmb_name(&called , dest_host, 0x20);
2160
2161         cli_set_port(cli, port);
2162         cli_set_timeout(cli, 10000); /* 10 seconds. */
2163
2164         if (dest_ss) {
2165                 ss = *dest_ss;
2166         } else {
2167                 zero_sockaddr(&ss);
2168         }
2169
2170 again:
2171
2172         DEBUG(3,("Connecting to host=%s\n", dest_host));
2173
2174         nt_status = cli_connect(cli, dest_host, &ss);
2175         if (!NT_STATUS_IS_OK(nt_status)) {
2176                 char addr[INET6_ADDRSTRLEN];
2177                 print_sockaddr(addr, sizeof(addr), &ss);
2178                 DEBUG(1,("cli_start_connection: failed to connect to %s (%s). Error %s\n",
2179                          nmb_namestr(&called), addr, nt_errstr(nt_status) ));
2180                 cli_shutdown(cli);
2181                 return nt_status;
2182         }
2183
2184         if (retry)
2185                 *retry = True;
2186
2187         if (!cli_session_request(cli, &calling, &called)) {
2188                 char *p;
2189                 DEBUG(1,("session request to %s failed (%s)\n",
2190                          called.name, cli_errstr(cli)));
2191                 if ((p=strchr(called.name, '.')) && !is_ipaddress(called.name)) {
2192                         *p = 0;
2193                         goto again;
2194                 }
2195                 if (strcmp(called.name, STAR_SMBSERVER)) {
2196                         make_nmb_name(&called , STAR_SMBSERVER, 0x20);
2197                         goto again;
2198                 }
2199                 return NT_STATUS_BAD_NETWORK_NAME;
2200         }
2201
2202         if (flags & CLI_FULL_CONNECTION_DONT_SPNEGO)
2203                 cli->use_spnego = False;
2204         else if (flags & CLI_FULL_CONNECTION_USE_KERBEROS)
2205                 cli->use_kerberos = True;
2206
2207         if ((flags & CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS) &&
2208              cli->use_kerberos) {
2209                 cli->fallback_after_kerberos = true;
2210         }
2211
2212         nt_status = cli_negprot(cli);
2213         if (!NT_STATUS_IS_OK(nt_status)) {
2214                 DEBUG(1, ("failed negprot: %s\n", nt_errstr(nt_status)));
2215                 cli_shutdown(cli);
2216                 return nt_status;
2217         }
2218
2219         *output_cli = cli;
2220         return NT_STATUS_OK;
2221 }
2222
2223
2224 /**
2225    establishes a connection right up to doing tconX, password specified.
2226    @param output_cli A fully initialised cli structure, non-null only on success
2227    @param dest_host The netbios name of the remote host
2228    @param dest_ip (optional) The the destination IP, NULL for name based lookup
2229    @param port (optional) The destination port (0 for default)
2230    @param service (optional) The share to make the connection to.  Should be 'unqualified' in any way.
2231    @param service_type The 'type' of serivice.
2232    @param user Username, unix string
2233    @param domain User's domain
2234    @param password User's password, unencrypted unix string.
2235    @param retry bool. Did this connection fail with a retryable error ?
2236 */
2237
2238 NTSTATUS cli_full_connection(struct cli_state **output_cli,
2239                              const char *my_name,
2240                              const char *dest_host,
2241                              struct sockaddr_storage *dest_ss, int port,
2242                              const char *service, const char *service_type,
2243                              const char *user, const char *domain,
2244                              const char *password, int flags,
2245                              int signing_state,
2246                              bool *retry)
2247 {
2248         NTSTATUS nt_status;
2249         struct cli_state *cli = NULL;
2250         int pw_len = password ? strlen(password)+1 : 0;
2251
2252         *output_cli = NULL;
2253
2254         if (password == NULL) {
2255                 password = "";
2256         }
2257
2258         nt_status = cli_start_connection(&cli, my_name, dest_host,
2259                                          dest_ss, port, signing_state,
2260                                          flags, retry);
2261
2262         if (!NT_STATUS_IS_OK(nt_status)) {
2263                 return nt_status;
2264         }
2265
2266         cli->use_oplocks = ((flags & CLI_FULL_CONNECTION_OPLOCKS) != 0);
2267         cli->use_level_II_oplocks =
2268                 ((flags & CLI_FULL_CONNECTION_LEVEL_II_OPLOCKS) != 0);
2269
2270         nt_status = cli_session_setup(cli, user, password, pw_len, password,
2271                                       pw_len, domain);
2272         if (!NT_STATUS_IS_OK(nt_status)) {
2273
2274                 if (!(flags & CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK)) {
2275                         DEBUG(1,("failed session setup with %s\n",
2276                                  nt_errstr(nt_status)));
2277                         cli_shutdown(cli);
2278                         return nt_status;
2279                 }
2280
2281                 nt_status = cli_session_setup(cli, "", "", 0, "", 0, domain);
2282                 if (!NT_STATUS_IS_OK(nt_status)) {
2283                         DEBUG(1,("anonymous failed session setup with %s\n",
2284                                  nt_errstr(nt_status)));
2285                         cli_shutdown(cli);
2286                         return nt_status;
2287                 }
2288         }
2289
2290         if (service) {
2291                 nt_status = cli_tcon_andx(cli, service, service_type, password,
2292                                           pw_len);
2293                 if (!NT_STATUS_IS_OK(nt_status)) {
2294                         DEBUG(1,("failed tcon_X with %s\n", nt_errstr(nt_status)));
2295                         cli_shutdown(cli);
2296                         if (NT_STATUS_IS_OK(nt_status)) {
2297                                 nt_status = NT_STATUS_UNSUCCESSFUL;
2298                         }
2299                         return nt_status;
2300                 }
2301         }
2302
2303         nt_status = cli_init_creds(cli, user, domain, password);
2304         if (!NT_STATUS_IS_OK(nt_status)) {
2305                 cli_shutdown(cli);
2306                 return nt_status;
2307         }
2308
2309         *output_cli = cli;
2310         return NT_STATUS_OK;
2311 }
2312
2313 /****************************************************************************
2314  Attempt a NetBIOS session request, falling back to *SMBSERVER if needed.
2315 ****************************************************************************/
2316
2317 bool attempt_netbios_session_request(struct cli_state **ppcli, const char *srchost, const char *desthost,
2318                                      struct sockaddr_storage *pdest_ss)
2319 {
2320         struct nmb_name calling, called;
2321
2322         make_nmb_name(&calling, srchost, 0x0);
2323
2324         /*
2325          * If the called name is an IP address
2326          * then use *SMBSERVER immediately.
2327          */
2328
2329         if(is_ipaddress(desthost)) {
2330                 make_nmb_name(&called, STAR_SMBSERVER, 0x20);
2331         } else {
2332                 make_nmb_name(&called, desthost, 0x20);
2333         }
2334
2335         if (!cli_session_request(*ppcli, &calling, &called)) {
2336                 NTSTATUS status;
2337                 struct nmb_name smbservername;
2338
2339                 make_nmb_name(&smbservername, STAR_SMBSERVER, 0x20);
2340
2341                 /*
2342                  * If the name wasn't *SMBSERVER then
2343                  * try with *SMBSERVER if the first name fails.
2344                  */
2345
2346                 if (nmb_name_equal(&called, &smbservername)) {
2347
2348                         /*
2349                          * The name used was *SMBSERVER, don't bother with another name.
2350                          */
2351
2352                         DEBUG(0,("attempt_netbios_session_request: %s rejected the session for name *SMBSERVER \
2353 with error %s.\n", desthost, cli_errstr(*ppcli) ));
2354                         return False;
2355                 }
2356
2357                 /* Try again... */
2358                 cli_shutdown(*ppcli);
2359
2360                 *ppcli = cli_initialise();
2361                 if (!*ppcli) {
2362                         /* Out of memory... */
2363                         return False;
2364                 }
2365
2366                 status = cli_connect(*ppcli, desthost, pdest_ss);
2367                 if (!NT_STATUS_IS_OK(status) ||
2368                                 !cli_session_request(*ppcli, &calling, &smbservername)) {
2369                         DEBUG(0,("attempt_netbios_session_request: %s rejected the session for \
2370 name *SMBSERVER with error %s\n", desthost, cli_errstr(*ppcli) ));
2371                         return False;
2372                 }
2373         }
2374
2375         return True;
2376 }
2377
2378 /****************************************************************************
2379  Send an old style tcon.
2380 ****************************************************************************/
2381 NTSTATUS cli_raw_tcon(struct cli_state *cli,
2382                       const char *service, const char *pass, const char *dev,
2383                       uint16 *max_xmit, uint16 *tid)
2384 {
2385         char *p;
2386
2387         if (!lp_client_plaintext_auth() && (*pass)) {
2388                 DEBUG(1, ("Server requested plaintext password but 'client "
2389                           "plaintext auth' is disabled\n"));
2390                 return NT_STATUS_ACCESS_DENIED;
2391         }
2392
2393         memset(cli->outbuf,'\0',smb_size);
2394         memset(cli->inbuf,'\0',smb_size);
2395
2396         cli_set_message(cli->outbuf, 0, 0, True);
2397         SCVAL(cli->outbuf,smb_com,SMBtcon);
2398         cli_setup_packet(cli);
2399
2400         p = smb_buf(cli->outbuf);
2401         *p++ = 4; p += clistr_push(cli, p, service, -1, STR_TERMINATE | STR_NOALIGN);
2402         *p++ = 4; p += clistr_push(cli, p, pass, -1, STR_TERMINATE | STR_NOALIGN);
2403         *p++ = 4; p += clistr_push(cli, p, dev, -1, STR_TERMINATE | STR_NOALIGN);
2404
2405         cli_setup_bcc(cli, p);
2406
2407         cli_send_smb(cli);
2408         if (!cli_receive_smb(cli)) {
2409                 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
2410         }
2411
2412         if (cli_is_error(cli)) {
2413                 return cli_nt_error(cli);
2414         }
2415
2416         *max_xmit = SVAL(cli->inbuf, smb_vwv0);
2417         *tid = SVAL(cli->inbuf, smb_vwv1);
2418
2419         return NT_STATUS_OK;
2420 }
2421
2422 /* Return a cli_state pointing at the IPC$ share for the given server */
2423
2424 struct cli_state *get_ipc_connect(char *server,
2425                                 struct sockaddr_storage *server_ss,
2426                                 const struct user_auth_info *user_info)
2427 {
2428         struct cli_state *cli;
2429         NTSTATUS nt_status;
2430         uint32_t flags = CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK;
2431
2432         if (user_info->use_kerberos) {
2433                 flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
2434         }
2435
2436         nt_status = cli_full_connection(&cli, NULL, server, server_ss, 0, "IPC$", "IPC",
2437                                         user_info->username ? user_info->username : "",
2438                                         lp_workgroup(),
2439                                         user_info->password ? user_info->password : "",
2440                                         flags,
2441                                         Undefined, NULL);
2442
2443         if (NT_STATUS_IS_OK(nt_status)) {
2444                 return cli;
2445         } else if (is_ipaddress(server)) {
2446             /* windows 9* needs a correct NMB name for connections */
2447             fstring remote_name;
2448
2449             if (name_status_find("*", 0, 0, server_ss, remote_name)) {
2450                 cli = get_ipc_connect(remote_name, server_ss, user_info);
2451                 if (cli)
2452                     return cli;
2453             }
2454         }
2455         return NULL;
2456 }
2457
2458 /*
2459  * Given the IP address of a master browser on the network, return its
2460  * workgroup and connect to it.
2461  *
2462  * This function is provided to allow additional processing beyond what
2463  * get_ipc_connect_master_ip_bcast() does, e.g. to retrieve the list of master
2464  * browsers and obtain each master browsers' list of domains (in case the
2465  * first master browser is recently on the network and has not yet
2466  * synchronized with other master browsers and therefore does not yet have the
2467  * entire network browse list)
2468  */
2469
2470 struct cli_state *get_ipc_connect_master_ip(TALLOC_CTX *ctx,
2471                                 struct ip_service *mb_ip,
2472                                 const struct user_auth_info *user_info,
2473                                 char **pp_workgroup_out)
2474 {
2475         char addr[INET6_ADDRSTRLEN];
2476         fstring name;
2477         struct cli_state *cli;
2478         struct sockaddr_storage server_ss;
2479
2480         *pp_workgroup_out = NULL;
2481
2482         print_sockaddr(addr, sizeof(addr), &mb_ip->ss);
2483         DEBUG(99, ("Looking up name of master browser %s\n",
2484                    addr));
2485
2486         /*
2487          * Do a name status query to find out the name of the master browser.
2488          * We use <01><02>__MSBROWSE__<02>#01 if *#00 fails because a domain
2489          * master browser will not respond to a wildcard query (or, at least,
2490          * an NT4 server acting as the domain master browser will not).
2491          *
2492          * We might be able to use ONLY the query on MSBROWSE, but that's not
2493          * yet been tested with all Windows versions, so until it is, leave
2494          * the original wildcard query as the first choice and fall back to
2495          * MSBROWSE if the wildcard query fails.
2496          */
2497         if (!name_status_find("*", 0, 0x1d, &mb_ip->ss, name) &&
2498             !name_status_find(MSBROWSE, 1, 0x1d, &mb_ip->ss, name)) {
2499
2500                 DEBUG(99, ("Could not retrieve name status for %s\n",
2501                            addr));
2502                 return NULL;
2503         }
2504
2505         if (!find_master_ip(name, &server_ss)) {
2506                 DEBUG(99, ("Could not find master ip for %s\n", name));
2507                 return NULL;
2508         }
2509
2510         *pp_workgroup_out = talloc_strdup(ctx, name);
2511
2512         DEBUG(4, ("found master browser %s, %s\n", name, addr));
2513
2514         print_sockaddr(addr, sizeof(addr), &server_ss);
2515         cli = get_ipc_connect(addr, &server_ss, user_info);
2516
2517         return cli;
2518 }
2519
2520 /*
2521  * Return the IP address and workgroup of a master browser on the network, and
2522  * connect to it.
2523  */
2524
2525 struct cli_state *get_ipc_connect_master_ip_bcast(TALLOC_CTX *ctx,
2526                                         const struct user_auth_info *user_info,
2527                                         char **pp_workgroup_out)
2528 {
2529         struct ip_service *ip_list;
2530         struct cli_state *cli;
2531         int i, count;
2532
2533         *pp_workgroup_out = NULL;
2534
2535         DEBUG(99, ("Do broadcast lookup for workgroups on local network\n"));
2536
2537         /* Go looking for workgroups by broadcasting on the local network */
2538
2539         if (!NT_STATUS_IS_OK(name_resolve_bcast(MSBROWSE, 1, &ip_list,
2540                                                 &count))) {
2541                 DEBUG(99, ("No master browsers responded\n"));
2542                 return False;
2543         }
2544
2545         for (i = 0; i < count; i++) {
2546                 char addr[INET6_ADDRSTRLEN];
2547                 print_sockaddr(addr, sizeof(addr), &ip_list[i].ss);
2548                 DEBUG(99, ("Found master browser %s\n", addr));
2549
2550                 cli = get_ipc_connect_master_ip(ctx, &ip_list[i],
2551                                 user_info, pp_workgroup_out);
2552                 if (cli)
2553                         return(cli);
2554         }
2555
2556         return NULL;
2557 }