source3/libsmb/cliconnect.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    client connect/disconnect routines
   4    Copyright (C) Andrew Tridgell 1994-1998
   5    Copyright (C) Andrew Bartlett 2001-2003
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "../libcli/auth/libcli_auth.h"
  23
  24 static const struct {
  25         int prot;
  26         const char name[24];
  27 } prots[10] = {
  28         {PROTOCOL_CORE,         "PC NETWORK PROGRAM 1.0"},
  29         {PROTOCOL_COREPLUS,     "MICROSOFT NETWORKS 1.03"},
  30         {PROTOCOL_LANMAN1,      "MICROSOFT NETWORKS 3.0"},
  31         {PROTOCOL_LANMAN1,      "LANMAN1.0"},
  32         {PROTOCOL_LANMAN2,      "LM1.2X002"},
  33         {PROTOCOL_LANMAN2,      "DOS LANMAN2.1"},
  34         {PROTOCOL_LANMAN2,      "LANMAN2.1"},
  35         {PROTOCOL_LANMAN2,      "Samba"},
  36         {PROTOCOL_NT1,          "NT LANMAN 1.0"},
  37         {PROTOCOL_NT1,          "NT LM 0.12"},
  38 };
  39
  40 #define STAR_SMBSERVER "*SMBSERVER"
  41
  42 /**
  43  * Set the user session key for a connection
  44  * @param cli The cli structure to add it too
  45  * @param session_key The session key used.  (A copy of this is taken for the cli struct)
  46  *
  47  */
  48
  49 static void cli_set_session_key (struct cli_state *cli, const DATA_BLOB session_key)
  50 {
  51         cli->user_session_key = data_blob(session_key.data, session_key.length);
  52 }
  53
  54 /****************************************************************************
  55  Do an old lanman2 style session setup.
  56 ****************************************************************************/
  57
  58 static NTSTATUS cli_session_setup_lanman2(struct cli_state *cli,
  59                                           const char *user,
  60                                           const char *pass, size_t passlen,
  61                                           const char *workgroup)
  62 {
  63         DATA_BLOB session_key = data_blob_null;
  64         DATA_BLOB lm_response = data_blob_null;
  65         NTSTATUS status;
  66         fstring pword;
  67         char *p;
  68
  69         if (passlen > sizeof(pword)-1) {
  70                 return NT_STATUS_INVALID_PARAMETER;
  71         }
  72
  73         /* LANMAN servers predate NT status codes and Unicode and ignore those
  74            smb flags so we must disable the corresponding default capabilities
  75            that would otherwise cause the Unicode and NT Status flags to be
  76            set (and even returned by the server) */
  77
  78         cli->capabilities &= ~(CAP_UNICODE | CAP_STATUS32);
  79
  80         /* if in share level security then don't send a password now */
  81         if (!(cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL))
  82                 passlen = 0;
  83
  84         if (passlen > 0 && (cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) && passlen != 24) {
  85                 /* Encrypted mode needed, and non encrypted password supplied. */
  86                 lm_response = data_blob(NULL, 24);
  87                 if (!SMBencrypt(pass, cli->secblob.data,(uchar *)lm_response.data)) {
  88                         DEBUG(1, ("Password is > 14 chars in length, and is therefore incompatible with Lanman authentication\n"));
  89                         return NT_STATUS_ACCESS_DENIED;
  90                 }
  91         } else if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) && passlen == 24) {
  92                 /* Encrypted mode needed, and encrypted password supplied. */
  93                 lm_response = data_blob(pass, passlen);
  94         } else if (passlen > 0) {
  95                 /* Plaintext mode needed, assume plaintext supplied. */
  96                 passlen = clistr_push(cli, pword, pass, sizeof(pword), STR_TERMINATE);
  97                 lm_response = data_blob(pass, passlen);
  98         }
  99
 100         /* send a session setup command */
 101         memset(cli->outbuf,'\0',smb_size);
 102         cli_set_message(cli->outbuf,10, 0, True);
 103         SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
 104         cli_setup_packet(cli);
 105
 106         SCVAL(cli->outbuf,smb_vwv0,0xFF);
 107         SSVAL(cli->outbuf,smb_vwv2,cli->max_xmit);
 108         SSVAL(cli->outbuf,smb_vwv3,2);
 109         SSVAL(cli->outbuf,smb_vwv4,1);
 110         SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
 111         SSVAL(cli->outbuf,smb_vwv7,lm_response.length);
 112
 113         p = smb_buf(cli->outbuf);
 114         memcpy(p,lm_response.data,lm_response.length);
 115         p += lm_response.length;
 116         p += clistr_push(cli, p, user, -1, STR_TERMINATE|STR_UPPER);
 117         p += clistr_push(cli, p, workgroup, -1, STR_TERMINATE|STR_UPPER);
 118         p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
 119         p += clistr_push(cli, p, "Samba", -1, STR_TERMINATE);
 120         cli_setup_bcc(cli, p);
 121
 122         if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
 123                 return cli_nt_error(cli);
 124         }
 125
 126         show_msg(cli->inbuf);
 127
 128         if (cli_is_error(cli)) {
 129                 return cli_nt_error(cli);
 130         }
 131
 132         /* use the returned vuid from now on */
 133         cli->vuid = SVAL(cli->inbuf,smb_uid);
 134         status = cli_set_username(cli, user);
 135         if (!NT_STATUS_IS_OK(status)) {
 136                 return status;
 137         }
 138
 139         if (session_key.data) {
 140                 /* Have plaintext orginal */
 141                 cli_set_session_key(cli, session_key);
 142         }
 143
 144         return NT_STATUS_OK;
 145 }
 146
 147 /****************************************************************************
 148  Work out suitable capabilities to offer the server.
 149 ****************************************************************************/
 150
 151 static uint32 cli_session_setup_capabilities(struct cli_state *cli)
 152 {
 153         uint32 capabilities = CAP_NT_SMBS;
 154
 155         if (!cli->force_dos_errors)
 156                 capabilities |= CAP_STATUS32;
 157
 158         if (cli->use_level_II_oplocks)
 159                 capabilities |= CAP_LEVEL_II_OPLOCKS;
 160
 161         capabilities |= (cli->capabilities & (CAP_UNICODE|CAP_LARGE_FILES|CAP_LARGE_READX|CAP_LARGE_WRITEX|CAP_DFS));
 162         return capabilities;
 163 }
 164
 165 /****************************************************************************
 166  Do a NT1 guest session setup.
 167 ****************************************************************************/
 168
 169 struct cli_session_setup_guest_state {
 170         struct cli_state *cli;
 171         uint16_t vwv[16];
 172         struct iovec bytes;
 173 };
 174
 175 static void cli_session_setup_guest_done(struct tevent_req *subreq);
 176
 177 struct tevent_req *cli_session_setup_guest_create(TALLOC_CTX *mem_ctx,
 178                                                   struct event_context *ev,
 179                                                   struct cli_state *cli,
 180                                                   struct tevent_req **psmbreq)
 181 {
 182         struct tevent_req *req, *subreq;
 183         struct cli_session_setup_guest_state *state;
 184         uint16_t *vwv;
 185         uint8_t *bytes;
 186
 187         req = tevent_req_create(mem_ctx, &state,
 188                                 struct cli_session_setup_guest_state);
 189         if (req == NULL) {
 190                 return NULL;
 191         }
 192         state->cli = cli;
 193         vwv = state->vwv;
 194
 195         SCVAL(vwv+0, 0, 0xFF);
 196         SCVAL(vwv+0, 1, 0);
 197         SSVAL(vwv+1, 0, 0);
 198         SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
 199         SSVAL(vwv+3, 0, 2);
 200         SSVAL(vwv+4, 0, cli->pid);
 201         SIVAL(vwv+5, 0, cli->sesskey);
 202         SSVAL(vwv+7, 0, 0);
 203         SSVAL(vwv+8, 0, 0);
 204         SSVAL(vwv+9, 0, 0);
 205         SSVAL(vwv+10, 0, 0);
 206         SIVAL(vwv+11, 0, cli_session_setup_capabilities(cli));
 207
 208         bytes = talloc_array(state, uint8_t, 0);
 209
 210         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "",  1, /* username */
 211                                    NULL);
 212         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "", 1, /* workgroup */
 213                                    NULL);
 214         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Unix", 5, NULL);
 215         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Samba", 6, NULL);
 216
 217         if (bytes == NULL) {
 218                 TALLOC_FREE(req);
 219                 return NULL;
 220         }
 221
 222         state->bytes.iov_base = (void *)bytes;
 223         state->bytes.iov_len = talloc_get_size(bytes);
 224
 225         subreq = cli_smb_req_create(state, ev, cli, SMBsesssetupX, 0, 13, vwv,
 226                                     1, &state->bytes);
 227         if (subreq == NULL) {
 228                 TALLOC_FREE(req);
 229                 return NULL;
 230         }
 231         tevent_req_set_callback(subreq, cli_session_setup_guest_done, req);
 232         *psmbreq = subreq;
 233         return req;
 234 }
 235
 236 struct tevent_req *cli_session_setup_guest_send(TALLOC_CTX *mem_ctx,
 237                                                 struct event_context *ev,
 238                                                 struct cli_state *cli)
 239 {
 240         struct tevent_req *req, *subreq;
 241         NTSTATUS status;
 242
 243         req = cli_session_setup_guest_create(mem_ctx, ev, cli, &subreq);
 244         if (req == NULL) {
 245                 return NULL;
 246         }
 247
 248         status = cli_smb_req_send(subreq);
 249         if (NT_STATUS_IS_OK(status)) {
 250                 tevent_req_nterror(req, status);
 251                 return tevent_req_post(req, ev);
 252         }
 253         return req;
 254 }
 255
 256 static void cli_session_setup_guest_done(struct tevent_req *subreq)
 257 {
 258         struct tevent_req *req = tevent_req_callback_data(
 259                 subreq, struct tevent_req);
 260         struct cli_session_setup_guest_state *state = tevent_req_data(
 261                 req, struct cli_session_setup_guest_state);
 262         struct cli_state *cli = state->cli;
 263         uint32_t num_bytes;
 264         char *inbuf;
 265         uint8_t *bytes;
 266         uint8_t *p;
 267         NTSTATUS status;
 268
 269         status = cli_smb_recv(subreq, 0, NULL, NULL, &num_bytes, &bytes);
 270         if (!NT_STATUS_IS_OK(status)) {
 271                 TALLOC_FREE(subreq);
 272                 tevent_req_nterror(req, status);
 273                 return;
 274         }
 275
 276         inbuf = (char *)cli_smb_inbuf(subreq);
 277         p = bytes;
 278
 279         cli->vuid = SVAL(inbuf, smb_uid);
 280
 281         p += clistr_pull(inbuf, cli->server_os, (char *)p, sizeof(fstring),
 282                          bytes+num_bytes-p, STR_TERMINATE);
 283         p += clistr_pull(inbuf, cli->server_type, (char *)p, sizeof(fstring),
 284                          bytes+num_bytes-p, STR_TERMINATE);
 285         p += clistr_pull(inbuf, cli->server_domain, (char *)p, sizeof(fstring),
 286                          bytes+num_bytes-p, STR_TERMINATE);
 287
 288         if (strstr(cli->server_type, "Samba")) {
 289                 cli->is_samba = True;
 290         }
 291
 292         TALLOC_FREE(subreq);
 293
 294         status = cli_set_username(cli, "");
 295         if (!NT_STATUS_IS_OK(status)) {
 296                 tevent_req_nterror(req, status);
 297                 return;
 298         }
 299         tevent_req_done(req);
 300 }
 301
 302 NTSTATUS cli_session_setup_guest_recv(struct tevent_req *req)
 303 {
 304         return tevent_req_simple_recv_ntstatus(req);
 305 }
 306
 307 static NTSTATUS cli_session_setup_guest(struct cli_state *cli)
 308 {
 309         TALLOC_CTX *frame = talloc_stackframe();
 310         struct event_context *ev;
 311         struct tevent_req *req;
 312         NTSTATUS status = NT_STATUS_OK;
 313
 314         if (cli_has_async_calls(cli)) {
 315                 /*
 316                  * Can't use sync call while an async call is in flight
 317                  */
 318                 status = NT_STATUS_INVALID_PARAMETER;
 319                 goto fail;
 320         }
 321
 322         ev = event_context_init(frame);
 323         if (ev == NULL) {
 324                 status = NT_STATUS_NO_MEMORY;
 325                 goto fail;
 326         }
 327
 328         req = cli_session_setup_guest_send(frame, ev, cli);
 329         if (req == NULL) {
 330                 status = NT_STATUS_NO_MEMORY;
 331                 goto fail;
 332         }
 333
 334         if (!tevent_req_poll(req, ev)) {
 335                 status = map_nt_error_from_unix(errno);
 336                 goto fail;
 337         }
 338
 339         status = cli_session_setup_guest_recv(req);
 340  fail:
 341         TALLOC_FREE(frame);
 342         if (!NT_STATUS_IS_OK(status)) {
 343                 cli_set_error(cli, status);
 344         }
 345         return status;
 346 }
 347
 348 /****************************************************************************
 349  Do a NT1 plaintext session setup.
 350 ****************************************************************************/
 351
 352 static NTSTATUS cli_session_setup_plaintext(struct cli_state *cli,
 353                                             const char *user, const char *pass,
 354                                             const char *workgroup)
 355 {
 356         uint32 capabilities = cli_session_setup_capabilities(cli);
 357         char *p;
 358         NTSTATUS status;
 359         fstring lanman;
 360
 361         fstr_sprintf( lanman, "Samba %s", samba_version_string());
 362
 363         memset(cli->outbuf, '\0', smb_size);
 364         cli_set_message(cli->outbuf,13,0,True);
 365         SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
 366         cli_setup_packet(cli);
 367
 368         SCVAL(cli->outbuf,smb_vwv0,0xFF);
 369         SSVAL(cli->outbuf,smb_vwv2,CLI_BUFFER_SIZE);
 370         SSVAL(cli->outbuf,smb_vwv3,2);
 371         SSVAL(cli->outbuf,smb_vwv4,cli->pid);
 372         SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
 373         SSVAL(cli->outbuf,smb_vwv8,0);
 374         SIVAL(cli->outbuf,smb_vwv11,capabilities);
 375         p = smb_buf(cli->outbuf);
 376
 377         /* check wether to send the ASCII or UNICODE version of the password */
 378
 379         if ( (capabilities & CAP_UNICODE) == 0 ) {
 380                 p += clistr_push(cli, p, pass, -1, STR_TERMINATE); /* password */
 381                 SSVAL(cli->outbuf,smb_vwv7,PTR_DIFF(p, smb_buf(cli->outbuf)));
 382         }
 383         else {
 384                 /* For ucs2 passwords clistr_push calls ucs2_align, which causes
 385                  * the space taken by the unicode password to be one byte too
 386                  * long (as we're on an odd byte boundary here). Reduce the
 387                  * count by 1 to cope with this. Fixes smbclient against NetApp
 388                  * servers which can't cope. Fix from
 389                  * bryan.kolodziej@allenlund.com in bug #3840.
 390                  */
 391                 p += clistr_push(cli, p, pass, -1, STR_UNICODE|STR_TERMINATE); /* unicode password */
 392                 SSVAL(cli->outbuf,smb_vwv8,PTR_DIFF(p, smb_buf(cli->outbuf))-1);
 393         }
 394
 395         p += clistr_push(cli, p, user, -1, STR_TERMINATE); /* username */
 396         p += clistr_push(cli, p, workgroup, -1, STR_TERMINATE); /* workgroup */
 397         p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
 398         p += clistr_push(cli, p, lanman, -1, STR_TERMINATE);
 399         cli_setup_bcc(cli, p);
 400
 401         if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
 402                 return cli_nt_error(cli);
 403         }
 404
 405         show_msg(cli->inbuf);
 406
 407         if (cli_is_error(cli)) {
 408                 return cli_nt_error(cli);
 409         }
 410
 411         cli->vuid = SVAL(cli->inbuf,smb_uid);
 412         p = smb_buf(cli->inbuf);
 413         p += clistr_pull(cli->inbuf, cli->server_os, p, sizeof(fstring),
 414                          -1, STR_TERMINATE);
 415         p += clistr_pull(cli->inbuf, cli->server_type, p, sizeof(fstring),
 416                          -1, STR_TERMINATE);
 417         p += clistr_pull(cli->inbuf, cli->server_domain, p, sizeof(fstring),
 418                          -1, STR_TERMINATE);
 419         status = cli_set_username(cli, user);
 420         if (!NT_STATUS_IS_OK(status)) {
 421                 return status;
 422         }
 423         if (strstr(cli->server_type, "Samba")) {
 424                 cli->is_samba = True;
 425         }
 426
 427         return NT_STATUS_OK;
 428 }
 429
 430 /****************************************************************************
 431    do a NT1 NTLM/LM encrypted session setup - for when extended security
 432    is not negotiated.
 433    @param cli client state to create do session setup on
 434    @param user username
 435    @param pass *either* cleartext password (passlen !=24) or LM response.
 436    @param ntpass NT response, implies ntpasslen >=24, implies pass is not clear
 437    @param workgroup The user's domain.
 438 ****************************************************************************/
 439
 440 static NTSTATUS cli_session_setup_nt1(struct cli_state *cli, const char *user,
 441                                       const char *pass, size_t passlen,
 442                                       const char *ntpass, size_t ntpasslen,
 443                                       const char *workgroup)
 444 {
 445         uint32 capabilities = cli_session_setup_capabilities(cli);
 446         DATA_BLOB lm_response = data_blob_null;
 447         DATA_BLOB nt_response = data_blob_null;
 448         DATA_BLOB session_key = data_blob_null;
 449         NTSTATUS result;
 450         char *p;
 451         bool ok;
 452
 453         if (passlen == 0) {
 454                 /* do nothing - guest login */
 455         } else if (passlen != 24) {
 456                 if (lp_client_ntlmv2_auth()) {
 457                         DATA_BLOB server_chal;
 458                         DATA_BLOB names_blob;
 459                         server_chal = data_blob(cli->secblob.data, MIN(cli->secblob.length, 8));
 460
 461                         /* note that the 'workgroup' here is a best guess - we don't know
 462                            the server's domain at this point.  The 'server name' is also
 463                            dodgy...
 464                         */
 465                         names_blob = NTLMv2_generate_names_blob(NULL, cli->called.name, workgroup);
 466
 467                         if (!SMBNTLMv2encrypt(NULL, user, workgroup, pass, &server_chal,
 468                                               &names_blob,
 469                                               &lm_response, &nt_response, NULL, &session_key)) {
 470                                 data_blob_free(&names_blob);
 471                                 data_blob_free(&server_chal);
 472                                 return NT_STATUS_ACCESS_DENIED;
 473                         }
 474                         data_blob_free(&names_blob);
 475                         data_blob_free(&server_chal);
 476
 477                 } else {
 478                         uchar nt_hash[16];
 479                         E_md4hash(pass, nt_hash);
 480
 481 #ifdef LANMAN_ONLY
 482                         nt_response = data_blob_null;
 483 #else
 484                         nt_response = data_blob(NULL, 24);
 485                         SMBNTencrypt(pass,cli->secblob.data,nt_response.data);
 486 #endif
 487                         /* non encrypted password supplied. Ignore ntpass. */
 488                         if (lp_client_lanman_auth()) {
 489                                 lm_response = data_blob(NULL, 24);
 490                                 if (!SMBencrypt(pass,cli->secblob.data, lm_response.data)) {
 491                                         /* Oops, the LM response is invalid, just put
 492                                            the NT response there instead */
 493                                         data_blob_free(&lm_response);
 494                                         lm_response = data_blob(nt_response.data, nt_response.length);
 495                                 }
 496                         } else {
 497                                 /* LM disabled, place NT# in LM field instead */
 498                                 lm_response = data_blob(nt_response.data, nt_response.length);
 499                         }
 500
 501                         session_key = data_blob(NULL, 16);
 502 #ifdef LANMAN_ONLY
 503                         E_deshash(pass, session_key.data);
 504                         memset(&session_key.data[8], '\0', 8);
 505 #else
 506                         SMBsesskeygen_ntv1(nt_hash, session_key.data);
 507 #endif
 508                 }
 509                 cli_temp_set_signing(cli);
 510         } else {
 511                 /* pre-encrypted password supplied.  Only used for
 512                    security=server, can't do
 513                    signing because we don't have original key */
 514
 515                 lm_response = data_blob(pass, passlen);
 516                 nt_response = data_blob(ntpass, ntpasslen);
 517         }
 518
 519         /* send a session setup command */
 520         memset(cli->outbuf,'\0',smb_size);
 521
 522         cli_set_message(cli->outbuf,13,0,True);
 523         SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
 524         cli_setup_packet(cli);
 525
 526         SCVAL(cli->outbuf,smb_vwv0,0xFF);
 527         SSVAL(cli->outbuf,smb_vwv2,CLI_BUFFER_SIZE);
 528         SSVAL(cli->outbuf,smb_vwv3,2);
 529         SSVAL(cli->outbuf,smb_vwv4,cli->pid);
 530         SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
 531         SSVAL(cli->outbuf,smb_vwv7,lm_response.length);
 532         SSVAL(cli->outbuf,smb_vwv8,nt_response.length);
 533         SIVAL(cli->outbuf,smb_vwv11,capabilities);
 534         p = smb_buf(cli->outbuf);
 535         if (lm_response.length) {
 536                 memcpy(p,lm_response.data, lm_response.length); p += lm_response.length;
 537         }
 538         if (nt_response.length) {
 539                 memcpy(p,nt_response.data, nt_response.length); p += nt_response.length;
 540         }
 541         p += clistr_push(cli, p, user, -1, STR_TERMINATE);
 542
 543         /* Upper case here might help some NTLMv2 implementations */
 544         p += clistr_push(cli, p, workgroup, -1, STR_TERMINATE|STR_UPPER);
 545         p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
 546         p += clistr_push(cli, p, "Samba", -1, STR_TERMINATE);
 547         cli_setup_bcc(cli, p);
 548
 549         if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
 550                 result = cli_nt_error(cli);
 551                 goto end;
 552         }
 553
 554         /* show_msg(cli->inbuf); */
 555
 556         if (cli_is_error(cli)) {
 557                 result = cli_nt_error(cli);
 558                 goto end;
 559         }
 560
 561 #ifdef LANMAN_ONLY
 562         ok = cli_simple_set_signing(cli, session_key, lm_response);
 563 #else
 564         ok = cli_simple_set_signing(cli, session_key, nt_response);
 565 #endif
 566         if (ok) {
 567                 if (!cli_check_sign_mac(cli, cli->inbuf, 1)) {
 568                         result = NT_STATUS_ACCESS_DENIED;
 569                         goto end;
 570                 }
 571         }
 572
 573         /* use the returned vuid from now on */
 574         cli->vuid = SVAL(cli->inbuf,smb_uid);
 575
 576         p = smb_buf(cli->inbuf);
 577         p += clistr_pull(cli->inbuf, cli->server_os, p, sizeof(fstring),
 578                          -1, STR_TERMINATE);
 579         p += clistr_pull(cli->inbuf, cli->server_type, p, sizeof(fstring),
 580                          -1, STR_TERMINATE);
 581         p += clistr_pull(cli->inbuf, cli->server_domain, p, sizeof(fstring),
 582                          -1, STR_TERMINATE);
 583
 584         if (strstr(cli->server_type, "Samba")) {
 585                 cli->is_samba = True;
 586         }
 587
 588         result = cli_set_username(cli, user);
 589         if (!NT_STATUS_IS_OK(result)) {
 590                 goto end;
 591         }
 592
 593         if (session_key.data) {
 594                 /* Have plaintext orginal */
 595                 cli_set_session_key(cli, session_key);
 596         }
 597
 598         result = NT_STATUS_OK;
 599 end:
 600         data_blob_free(&lm_response);
 601         data_blob_free(&nt_response);
 602         data_blob_free(&session_key);
 603         return result;
 604 }
 605
 606 /****************************************************************************
 607  Send a extended security session setup blob
 608 ****************************************************************************/
 609
 610 static bool cli_session_setup_blob_send(struct cli_state *cli, DATA_BLOB blob)
 611 {
 612         uint32 capabilities = cli_session_setup_capabilities(cli);
 613         char *p;
 614
 615         capabilities |= CAP_EXTENDED_SECURITY;
 616
 617         /* send a session setup command */
 618         memset(cli->outbuf,'\0',smb_size);
 619
 620         cli_set_message(cli->outbuf,12,0,True);
 621         SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
 622
 623         cli_setup_packet(cli);
 624
 625         SCVAL(cli->outbuf,smb_vwv0,0xFF);
 626         SSVAL(cli->outbuf,smb_vwv2,CLI_BUFFER_SIZE);
 627         SSVAL(cli->outbuf,smb_vwv3,2);
 628         SSVAL(cli->outbuf,smb_vwv4,1);
 629         SIVAL(cli->outbuf,smb_vwv5,0);
 630         SSVAL(cli->outbuf,smb_vwv7,blob.length);
 631         SIVAL(cli->outbuf,smb_vwv10,capabilities);
 632         p = smb_buf(cli->outbuf);
 633         memcpy(p, blob.data, blob.length);
 634         p += blob.length;
 635         p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
 636         p += clistr_push(cli, p, "Samba", -1, STR_TERMINATE);
 637         cli_setup_bcc(cli, p);
 638         return cli_send_smb(cli);
 639 }
 640
 641 /****************************************************************************
 642  Send a extended security session setup blob, returning a reply blob.
 643 ****************************************************************************/
 644
 645 static DATA_BLOB cli_session_setup_blob_receive(struct cli_state *cli)
 646 {
 647         DATA_BLOB blob2 = data_blob_null;
 648         char *p;
 649         size_t len;
 650
 651         if (!cli_receive_smb(cli))
 652                 return blob2;
 653
 654         show_msg(cli->inbuf);
 655
 656         if (cli_is_error(cli) && !NT_STATUS_EQUAL(cli_nt_error(cli),
 657                                                   NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 658                 return blob2;
 659         }
 660
 661         /* use the returned vuid from now on */
 662         cli->vuid = SVAL(cli->inbuf,smb_uid);
 663
 664         p = smb_buf(cli->inbuf);
 665
 666         blob2 = data_blob(p, SVAL(cli->inbuf, smb_vwv3));
 667
 668         p += blob2.length;
 669         p += clistr_pull(cli->inbuf, cli->server_os, p, sizeof(fstring),
 670                          -1, STR_TERMINATE);
 671
 672         /* w2k with kerberos doesn't properly null terminate this field */
 673         len = smb_bufrem(cli->inbuf, p);
 674         if (p + len < cli->inbuf + cli->bufsize+SAFETY_MARGIN - 2) {
 675                 char *end_of_buf = p + len;
 676
 677                 SSVAL(p, len, 0);
 678                 /* Now it's null terminated. */
 679                 p += clistr_pull(cli->inbuf, cli->server_type, p, sizeof(fstring),
 680                         -1, STR_TERMINATE);
 681                 /*
 682                  * See if there's another string. If so it's the
 683                  * server domain (part of the 'standard' Samba
 684                  * server signature).
 685                  */
 686                 if (p < end_of_buf) {
 687                         p += clistr_pull(cli->inbuf, cli->server_domain, p, sizeof(fstring),
 688                                 -1, STR_TERMINATE);
 689                 }
 690         } else {
 691                 /*
 692                  * No room to null terminate so we can't see if there
 693                  * is another string (server_domain) afterwards.
 694                  */
 695                 p += clistr_pull(cli->inbuf, cli->server_type, p, sizeof(fstring),
 696                                  len, 0);
 697         }
 698         return blob2;
 699 }
 700
 701 #ifdef HAVE_KRB5
 702 /****************************************************************************
 703  Send a extended security session setup blob, returning a reply blob.
 704 ****************************************************************************/
 705
 706 /* The following is calculated from :
 707  * (smb_size-4) = 35
 708  * (smb_wcnt * 2) = 24 (smb_wcnt == 12 in cli_session_setup_blob_send() )
 709  * (strlen("Unix") + 1 + strlen("Samba") + 1) * 2 = 22 (unicode strings at
 710  * end of packet.
 711  */
 712
 713 #define BASE_SESSSETUP_BLOB_PACKET_SIZE (35 + 24 + 22)
 714
 715 static bool cli_session_setup_blob(struct cli_state *cli, DATA_BLOB blob)
 716 {
 717         int32 remaining = blob.length;
 718         int32 cur = 0;
 719         DATA_BLOB send_blob = data_blob_null;
 720         int32 max_blob_size = 0;
 721         DATA_BLOB receive_blob = data_blob_null;
 722
 723         if (cli->max_xmit < BASE_SESSSETUP_BLOB_PACKET_SIZE + 1) {
 724                 DEBUG(0,("cli_session_setup_blob: cli->max_xmit too small "
 725                         "(was %u, need minimum %u)\n",
 726                         (unsigned int)cli->max_xmit,
 727                         BASE_SESSSETUP_BLOB_PACKET_SIZE));
 728                 cli_set_nt_error(cli, NT_STATUS_INVALID_PARAMETER);
 729                 return False;
 730         }
 731
 732         max_blob_size = cli->max_xmit - BASE_SESSSETUP_BLOB_PACKET_SIZE;
 733
 734         while ( remaining > 0) {
 735                 if (remaining >= max_blob_size) {
 736                         send_blob.length = max_blob_size;
 737                         remaining -= max_blob_size;
 738                 } else {
 739                         send_blob.length = remaining;
 740                         remaining = 0;
 741                 }
 742
 743                 send_blob.data =  &blob.data[cur];
 744                 cur += send_blob.length;
 745
 746                 DEBUG(10, ("cli_session_setup_blob: Remaining (%u) sending (%u) current (%u)\n",
 747                         (unsigned int)remaining,
 748                         (unsigned int)send_blob.length,
 749                         (unsigned int)cur ));
 750
 751                 if (!cli_session_setup_blob_send(cli, send_blob)) {
 752                         DEBUG(0, ("cli_session_setup_blob: send failed\n"));
 753                         return False;
 754                 }
 755
 756                 receive_blob = cli_session_setup_blob_receive(cli);
 757                 data_blob_free(&receive_blob);
 758
 759                 if (cli_is_error(cli) &&
 760                                 !NT_STATUS_EQUAL( cli_get_nt_error(cli),
 761                                         NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 762                         DEBUG(0, ("cli_session_setup_blob: receive failed "
 763                                   "(%s)\n", nt_errstr(cli_get_nt_error(cli))));
 764                         cli->vuid = 0;
 765                         return False;
 766                 }
 767         }
 768
 769         return True;
 770 }
 771
 772 /****************************************************************************
 773  Use in-memory credentials cache
 774 ****************************************************************************/
 775
 776 static void use_in_memory_ccache(void) {
 777         setenv(KRB5_ENV_CCNAME, "MEMORY:cliconnect", 1);
 778 }
 779
 780 /****************************************************************************
 781  Do a spnego/kerberos encrypted session setup.
 782 ****************************************************************************/
 783
 784 static ADS_STATUS cli_session_setup_kerberos(struct cli_state *cli, const char *principal, const char *workgroup)
 785 {
 786         DATA_BLOB negTokenTarg;
 787         DATA_BLOB session_key_krb5;
 788         NTSTATUS nt_status;
 789         int rc;
 790
 791         cli_temp_set_signing(cli);
 792
 793         DEBUG(2,("Doing kerberos session setup\n"));
 794
 795         /* generate the encapsulated kerberos5 ticket */
 796         rc = spnego_gen_negTokenTarg(principal, 0, &negTokenTarg, &session_key_krb5, 0, NULL);
 797
 798         if (rc) {
 799                 DEBUG(1, ("cli_session_setup_kerberos: spnego_gen_negTokenTarg failed: %s\n",
 800                         error_message(rc)));
 801                 return ADS_ERROR_KRB5(rc);
 802         }
 803
 804 #if 0
 805         file_save("negTokenTarg.dat", negTokenTarg.data, negTokenTarg.length);
 806 #endif
 807
 808         if (!cli_session_setup_blob(cli, negTokenTarg)) {
 809                 nt_status = cli_nt_error(cli);
 810                 goto nt_error;
 811         }
 812
 813         if (cli_is_error(cli)) {
 814                 nt_status = cli_nt_error(cli);
 815                 if (NT_STATUS_IS_OK(nt_status)) {
 816                         nt_status = NT_STATUS_UNSUCCESSFUL;
 817                 }
 818                 goto nt_error;
 819         }
 820
 821         cli_set_session_key(cli, session_key_krb5);
 822
 823         if (cli_simple_set_signing(
 824                     cli, session_key_krb5, data_blob_null)) {
 825
 826                 if (!cli_check_sign_mac(cli, cli->inbuf, 1)) {
 827                         nt_status = NT_STATUS_ACCESS_DENIED;
 828                         goto nt_error;
 829                 }
 830         }
 831
 832         data_blob_free(&negTokenTarg);
 833         data_blob_free(&session_key_krb5);
 834
 835         return ADS_ERROR_NT(NT_STATUS_OK);
 836
 837 nt_error:
 838         data_blob_free(&negTokenTarg);
 839         data_blob_free(&session_key_krb5);
 840         cli->vuid = 0;
 841         return ADS_ERROR_NT(nt_status);
 842 }
 843 #endif  /* HAVE_KRB5 */
 844
 845
 846 /****************************************************************************
 847  Do a spnego/NTLMSSP encrypted session setup.
 848 ****************************************************************************/
 849
 850 static NTSTATUS cli_session_setup_ntlmssp(struct cli_state *cli, const char *user,
 851                                           const char *pass, const char *domain)
 852 {
 853         struct ntlmssp_state *ntlmssp_state;
 854         NTSTATUS nt_status;
 855         int turn = 1;
 856         DATA_BLOB msg1;
 857         DATA_BLOB blob = data_blob_null;
 858         DATA_BLOB blob_in = data_blob_null;
 859         DATA_BLOB blob_out = data_blob_null;
 860
 861         cli_temp_set_signing(cli);
 862
 863         if (!NT_STATUS_IS_OK(nt_status = ntlmssp_client_start(&ntlmssp_state))) {
 864                 return nt_status;
 865         }
 866         ntlmssp_want_feature(ntlmssp_state, NTLMSSP_FEATURE_SESSION_KEY);
 867
 868         if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_username(ntlmssp_state, user))) {
 869                 return nt_status;
 870         }
 871         if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_domain(ntlmssp_state, domain))) {
 872                 return nt_status;
 873         }
 874         if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_password(ntlmssp_state, pass))) {
 875                 return nt_status;
 876         }
 877
 878         do {
 879                 nt_status = ntlmssp_update(ntlmssp_state,
 880                                                   blob_in, &blob_out);
 881                 data_blob_free(&blob_in);
 882                 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED) || NT_STATUS_IS_OK(nt_status)) {
 883                         if (turn == 1) {
 884                                 /* and wrap it in a SPNEGO wrapper */
 885                                 msg1 = gen_negTokenInit(OID_NTLMSSP, blob_out);
 886                         } else {
 887                                 /* wrap it in SPNEGO */
 888                                 msg1 = spnego_gen_auth(blob_out);
 889                         }
 890
 891                         /* now send that blob on its way */
 892                         if (!cli_session_setup_blob_send(cli, msg1)) {
 893                                 DEBUG(3, ("Failed to send NTLMSSP/SPNEGO blob to server!\n"));
 894                                 nt_status = NT_STATUS_UNSUCCESSFUL;
 895                         } else {
 896                                 blob = cli_session_setup_blob_receive(cli);
 897
 898                                 nt_status = cli_nt_error(cli);
 899                                 if (cli_is_error(cli) && NT_STATUS_IS_OK(nt_status)) {
 900                                         if (cli->smb_rw_error == SMB_READ_BAD_SIG) {
 901                                                 nt_status = NT_STATUS_ACCESS_DENIED;
 902                                         } else {
 903                                                 nt_status = NT_STATUS_UNSUCCESSFUL;
 904                                         }
 905                                 }
 906                         }
 907                         data_blob_free(&msg1);
 908                 }
 909
 910                 if (!blob.length) {
 911                         if (NT_STATUS_IS_OK(nt_status)) {
 912                                 nt_status = NT_STATUS_UNSUCCESSFUL;
 913                         }
 914                 } else if ((turn == 1) &&
 915                            NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 916                         DATA_BLOB tmp_blob = data_blob_null;
 917                         /* the server might give us back two challenges */
 918                         if (!spnego_parse_challenge(blob, &blob_in,
 919                                                     &tmp_blob)) {
 920                                 DEBUG(3,("Failed to parse challenges\n"));
 921                                 nt_status = NT_STATUS_INVALID_PARAMETER;
 922                         }
 923                         data_blob_free(&tmp_blob);
 924                 } else {
 925                         if (!spnego_parse_auth_response(blob, nt_status, OID_NTLMSSP,
 926                                                         &blob_in)) {
 927                                 DEBUG(3,("Failed to parse auth response\n"));
 928                                 if (NT_STATUS_IS_OK(nt_status)
 929                                     || NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED))
 930                                         nt_status = NT_STATUS_INVALID_PARAMETER;
 931                         }
 932                 }
 933                 data_blob_free(&blob);
 934                 data_blob_free(&blob_out);
 935                 turn++;
 936         } while (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED));
 937
 938         data_blob_free(&blob_in);
 939
 940         if (NT_STATUS_IS_OK(nt_status)) {
 941
 942                 if (cli->server_domain[0] == '\0') {
 943                         fstrcpy(cli->server_domain, ntlmssp_state->server_domain);
 944                 }
 945                 cli_set_session_key(cli, ntlmssp_state->session_key);
 946
 947                 if (cli_simple_set_signing(
 948                             cli, ntlmssp_state->session_key, data_blob_null)) {
 949
 950                         if (!cli_check_sign_mac(cli, cli->inbuf, 1)) {
 951                                 nt_status = NT_STATUS_ACCESS_DENIED;
 952                         }
 953                 }
 954         }
 955
 956         /* we have a reference conter on ntlmssp_state, if we are signing
 957            then the state will be kept by the signing engine */
 958
 959         ntlmssp_end(&ntlmssp_state);
 960
 961         if (!NT_STATUS_IS_OK(nt_status)) {
 962                 cli->vuid = 0;
 963         }
 964         return nt_status;
 965 }
 966
 967 /****************************************************************************
 968  Do a spnego encrypted session setup.
 969
 970  user_domain: The shortname of the domain the user/machine is a member of.
 971  dest_realm: The realm we're connecting to, if NULL we use our default realm.
 972 ****************************************************************************/
 973
 974 ADS_STATUS cli_session_setup_spnego(struct cli_state *cli, const char *user,
 975                               const char *pass, const char *user_domain,
 976                               const char * dest_realm)
 977 {
 978         char *principal = NULL;
 979         char *OIDs[ASN1_MAX_OIDS];
 980         int i;
 981         DATA_BLOB blob;
 982         const char *p = NULL;
 983         char *account = NULL;
 984         NTSTATUS status;
 985
 986         DEBUG(3,("Doing spnego session setup (blob length=%lu)\n", (unsigned long)cli->secblob.length));
 987
 988         /* the server might not even do spnego */
 989         if (cli->secblob.length <= 16) {
 990                 DEBUG(3,("server didn't supply a full spnego negprot\n"));
 991                 goto ntlmssp;
 992         }
 993
 994 #if 0
 995         file_save("negprot.dat", cli->secblob.data, cli->secblob.length);
 996 #endif
 997
 998         /* there is 16 bytes of GUID before the real spnego packet starts */
 999         blob = data_blob(cli->secblob.data+16, cli->secblob.length-16);
1000
1001         /* The server sent us the first part of the SPNEGO exchange in the
1002          * negprot reply. It is WRONG to depend on the principal sent in the
1003          * negprot reply, but right now we do it. If we don't receive one,
1004          * we try to best guess, then fall back to NTLM.  */
1005         if (!spnego_parse_negTokenInit(blob, OIDs, &principal)) {
1006                 data_blob_free(&blob);
1007                 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1008         }
1009         data_blob_free(&blob);
1010
1011         /* make sure the server understands kerberos */
1012         for (i=0;OIDs[i];i++) {
1013                 if (i == 0)
1014                         DEBUG(3,("got OID=%s\n", OIDs[i]));
1015                 else
1016                         DEBUGADD(3,("got OID=%s\n", OIDs[i]));
1017                 if (strcmp(OIDs[i], OID_KERBEROS5_OLD) == 0 ||
1018                     strcmp(OIDs[i], OID_KERBEROS5) == 0) {
1019                         cli->got_kerberos_mechanism = True;
1020                 }
1021                 talloc_free(OIDs[i]);
1022         }
1023
1024         DEBUG(3,("got principal=%s\n", principal ? principal : "<null>"));
1025
1026         status = cli_set_username(cli, user);
1027         if (!NT_STATUS_IS_OK(status)) {
1028                 return ADS_ERROR_NT(status);
1029         }
1030
1031 #ifdef HAVE_KRB5
1032         /* If password is set we reauthenticate to kerberos server
1033          * and do not store results */
1034
1035         if (cli->got_kerberos_mechanism && cli->use_kerberos) {
1036                 ADS_STATUS rc;
1037
1038                 if (pass && *pass) {
1039                         int ret;
1040
1041                         use_in_memory_ccache();
1042                         ret = kerberos_kinit_password(user, pass, 0 /* no time correction for now */, NULL);
1043
1044                         if (ret){
1045                                 TALLOC_FREE(principal);
1046                                 DEBUG(0, ("Kinit failed: %s\n", error_message(ret)));
1047                                 if (cli->fallback_after_kerberos)
1048                                         goto ntlmssp;
1049                                 return ADS_ERROR_KRB5(ret);
1050                         }
1051                 }
1052
1053                 /* If we get a bad principal, try to guess it if
1054                    we have a valid host NetBIOS name.
1055                  */
1056                 if (strequal(principal, ADS_IGNORE_PRINCIPAL)) {
1057                         TALLOC_FREE(principal);
1058                 }
1059
1060                 if (principal == NULL &&
1061                         !is_ipaddress(cli->desthost) &&
1062                         !strequal(STAR_SMBSERVER,
1063                                 cli->desthost)) {
1064                         char *realm = NULL;
1065                         char *machine = NULL;
1066                         char *host = NULL;
1067                         DEBUG(3,("cli_session_setup_spnego: got a "
1068                                 "bad server principal, trying to guess ...\n"));
1069
1070                         host = strchr_m(cli->desthost, '.');
1071                         if (host) {
1072                                 machine = SMB_STRNDUP(cli->desthost,
1073                                         host - cli->desthost);
1074                         } else {
1075                                 machine = SMB_STRDUP(cli->desthost);
1076                         }
1077                         if (machine == NULL) {
1078                                 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1079                         }
1080
1081                         if (dest_realm) {
1082                                 realm = SMB_STRDUP(dest_realm);
1083                                 strupper_m(realm);
1084                         } else {
1085                                 realm = kerberos_get_default_realm_from_ccache();
1086                         }
1087                         if (realm && *realm) {
1088                                 principal = talloc_asprintf(NULL, "%s$@%s",
1089                                                         machine, realm);
1090                                 if (!principal) {
1091                                         SAFE_FREE(machine);
1092                                         SAFE_FREE(realm);
1093                                         return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1094                                 }
1095                                 DEBUG(3,("cli_session_setup_spnego: guessed "
1096                                         "server principal=%s\n",
1097                                         principal ? principal : "<null>"));
1098                         }
1099                         SAFE_FREE(machine);
1100                         SAFE_FREE(realm);
1101                 }
1102
1103                 if (principal) {
1104                         rc = cli_session_setup_kerberos(cli, principal,
1105                                 dest_realm);
1106                         if (ADS_ERR_OK(rc) || !cli->fallback_after_kerberos) {
1107                                 TALLOC_FREE(principal);
1108                                 return rc;
1109                         }
1110                 }
1111         }
1112 #endif
1113
1114         TALLOC_FREE(principal);
1115
1116 ntlmssp:
1117
1118         account = talloc_strdup(talloc_tos(), user);
1119         if (!account) {
1120                 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1121         }
1122
1123         /* when falling back to ntlmssp while authenticating with a machine
1124          * account strip off the realm - gd */
1125
1126         if ((p = strchr_m(user, '@')) != NULL) {
1127                 account[PTR_DIFF(p,user)] = '\0';
1128         }
1129
1130         return ADS_ERROR_NT(cli_session_setup_ntlmssp(cli, account, pass, user_domain));
1131 }
1132
1133 /****************************************************************************
1134  Send a session setup. The username and workgroup is in UNIX character
1135  format and must be converted to DOS codepage format before sending. If the
1136  password is in plaintext, the same should be done.
1137 ****************************************************************************/
1138
1139 NTSTATUS cli_session_setup(struct cli_state *cli,
1140                            const char *user,
1141                            const char *pass, int passlen,
1142                            const char *ntpass, int ntpasslen,
1143                            const char *workgroup)
1144 {
1145         char *p;
1146         fstring user2;
1147
1148         if (user) {
1149                 fstrcpy(user2, user);
1150         } else {
1151                 user2[0] ='\0';
1152         }
1153
1154         if (!workgroup) {
1155                 workgroup = "";
1156         }
1157
1158         /* allow for workgroups as part of the username */
1159         if ((p=strchr_m(user2,'\\')) || (p=strchr_m(user2,'/')) ||
1160             (p=strchr_m(user2,*lp_winbind_separator()))) {
1161                 *p = 0;
1162                 user = p+1;
1163                 workgroup = user2;
1164         }
1165
1166         if (cli->protocol < PROTOCOL_LANMAN1) {
1167                 return NT_STATUS_OK;
1168         }
1169
1170         /* now work out what sort of session setup we are going to
1171            do. I have split this into separate functions to make the
1172            flow a bit easier to understand (tridge) */
1173
1174         /* if its an older server then we have to use the older request format */
1175
1176         if (cli->protocol < PROTOCOL_NT1) {
1177                 if (!lp_client_lanman_auth() && passlen != 24 && (*pass)) {
1178                         DEBUG(1, ("Server requested LM password but 'client lanman auth'"
1179                                   " is disabled\n"));
1180                         return NT_STATUS_ACCESS_DENIED;
1181                 }
1182
1183                 if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0 &&
1184                     !lp_client_plaintext_auth() && (*pass)) {
1185                         DEBUG(1, ("Server requested plaintext password but "
1186                                   "'client plaintext auth' is disabled\n"));
1187                         return NT_STATUS_ACCESS_DENIED;
1188                 }
1189
1190                 return cli_session_setup_lanman2(cli, user, pass, passlen,
1191                                                  workgroup);
1192         }
1193
1194         /* if no user is supplied then we have to do an anonymous connection.
1195            passwords are ignored */
1196
1197         if (!user || !*user)
1198                 return cli_session_setup_guest(cli);
1199
1200         /* if the server is share level then send a plaintext null
1201            password at this point. The password is sent in the tree
1202            connect */
1203
1204         if ((cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) == 0)
1205                 return cli_session_setup_plaintext(cli, user, "", workgroup);
1206
1207         /* if the server doesn't support encryption then we have to use
1208            plaintext. The second password is ignored */
1209
1210         if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0) {
1211                 if (!lp_client_plaintext_auth() && (*pass)) {
1212                         DEBUG(1, ("Server requested plaintext password but "
1213                                   "'client plaintext auth' is disabled\n"));
1214                         return NT_STATUS_ACCESS_DENIED;
1215                 }
1216                 return cli_session_setup_plaintext(cli, user, pass, workgroup);
1217         }
1218
1219         /* if the server supports extended security then use SPNEGO */
1220
1221         if (cli->capabilities & CAP_EXTENDED_SECURITY) {
1222                 ADS_STATUS status = cli_session_setup_spnego(cli, user, pass,
1223                                                              workgroup, NULL);
1224                 if (!ADS_ERR_OK(status)) {
1225                         DEBUG(3, ("SPNEGO login failed: %s\n", ads_errstr(status)));
1226                         return ads_ntstatus(status);
1227                 }
1228         } else {
1229                 NTSTATUS status;
1230
1231                 /* otherwise do a NT1 style session setup */
1232                 status = cli_session_setup_nt1(cli, user, pass, passlen,
1233                                                ntpass, ntpasslen, workgroup);
1234                 if (!NT_STATUS_IS_OK(status)) {
1235                         DEBUG(3,("cli_session_setup: NT1 session setup "
1236                                  "failed: %s\n", nt_errstr(status)));
1237                         return status;
1238                 }
1239         }
1240
1241         if (strstr(cli->server_type, "Samba")) {
1242                 cli->is_samba = True;
1243         }
1244
1245         return NT_STATUS_OK;
1246 }
1247
1248 /****************************************************************************
1249  Send a uloggoff.
1250 *****************************************************************************/
1251
1252 bool cli_ulogoff(struct cli_state *cli)
1253 {
1254         memset(cli->outbuf,'\0',smb_size);
1255         cli_set_message(cli->outbuf,2,0,True);
1256         SCVAL(cli->outbuf,smb_com,SMBulogoffX);
1257         cli_setup_packet(cli);
1258         SSVAL(cli->outbuf,smb_vwv0,0xFF);
1259         SSVAL(cli->outbuf,smb_vwv2,0);  /* no additional info */
1260
1261         cli_send_smb(cli);
1262         if (!cli_receive_smb(cli))
1263                 return False;
1264
1265         if (cli_is_error(cli)) {
1266                 return False;
1267         }
1268
1269         cli->vuid = -1;
1270         return True;
1271 }
1272
1273 /****************************************************************************
1274  Send a tconX.
1275 ****************************************************************************/
1276
1277 struct cli_tcon_andx_state {
1278         struct cli_state *cli;
1279         uint16_t vwv[4];
1280         struct iovec bytes;
1281 };
1282
1283 static void cli_tcon_andx_done(struct tevent_req *subreq);
1284
1285 struct tevent_req *cli_tcon_andx_create(TALLOC_CTX *mem_ctx,
1286                                         struct event_context *ev,
1287                                         struct cli_state *cli,
1288                                         const char *share, const char *dev,
1289                                         const char *pass, int passlen,
1290                                         struct tevent_req **psmbreq)
1291 {
1292         struct tevent_req *req, *subreq;
1293         struct cli_tcon_andx_state *state;
1294         fstring pword;
1295         uint16_t *vwv;
1296         char *tmp = NULL;
1297         uint8_t *bytes;
1298
1299         req = tevent_req_create(mem_ctx, &state, struct cli_tcon_andx_state);
1300         if (req == NULL) {
1301                 return NULL;
1302         }
1303         state->cli = cli;
1304         vwv = state->vwv;
1305
1306         fstrcpy(cli->share, share);
1307
1308         /* in user level security don't send a password now */
1309         if (cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) {
1310                 passlen = 1;
1311                 pass = "";
1312         } else if (pass == NULL) {
1313                 DEBUG(1, ("Server not using user level security and no "
1314                           "password supplied.\n"));
1315                 goto access_denied;
1316         }
1317
1318         if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) &&
1319             *pass && passlen != 24) {
1320                 if (!lp_client_lanman_auth()) {
1321                         DEBUG(1, ("Server requested LANMAN password "
1322                                   "(share-level security) but "
1323                                   "'client lanman auth' is disabled\n"));
1324                         goto access_denied;
1325                 }
1326
1327                 /*
1328                  * Non-encrypted passwords - convert to DOS codepage before
1329                  * encryption.
1330                  */
1331                 passlen = 24;
1332                 SMBencrypt(pass, cli->secblob.data, (uchar *)pword);
1333         } else {
1334                 if((cli->sec_mode & (NEGOTIATE_SECURITY_USER_LEVEL
1335                                      |NEGOTIATE_SECURITY_CHALLENGE_RESPONSE))
1336                    == 0) {
1337                         if (!lp_client_plaintext_auth() && (*pass)) {
1338                                 DEBUG(1, ("Server requested plaintext "
1339                                           "password but 'client plaintext "
1340                                           "auth' is disabled\n"));
1341                                 goto access_denied;
1342                         }
1343
1344                         /*
1345                          * Non-encrypted passwords - convert to DOS codepage
1346                          * before using.
1347                          */
1348                         passlen = clistr_push(cli, pword, pass, sizeof(pword),
1349                                               STR_TERMINATE);
1350                         if (passlen == -1) {
1351                                 DEBUG(1, ("clistr_push(pword) failed\n"));
1352                                 goto access_denied;
1353                         }
1354                 } else {
1355                         if (passlen) {
1356                                 memcpy(pword, pass, passlen);
1357                         }
1358                 }
1359         }
1360
1361         SCVAL(vwv+0, 0, 0xFF);
1362         SCVAL(vwv+0, 1, 0);
1363         SSVAL(vwv+1, 0, 0);
1364         SSVAL(vwv+2, 0, TCONX_FLAG_EXTENDED_RESPONSE);
1365         SSVAL(vwv+3, 0, passlen);
1366
1367         if (passlen) {
1368                 bytes = (uint8_t *)talloc_memdup(state, pword, passlen);
1369         } else {
1370                 bytes = talloc_array(state, uint8_t, 0);
1371         }
1372
1373         /*
1374          * Add the sharename
1375          */
1376         tmp = talloc_asprintf_strupper_m(talloc_tos(), "\\\\%s\\%s",
1377                                          cli->desthost, share);
1378         if (tmp == NULL) {
1379                 TALLOC_FREE(req);
1380                 return NULL;
1381         }
1382         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), tmp, strlen(tmp)+1,
1383                                    NULL);
1384         TALLOC_FREE(tmp);
1385
1386         /*
1387          * Add the devicetype
1388          */
1389         tmp = talloc_strdup_upper(talloc_tos(), dev);
1390         if (tmp == NULL) {
1391                 TALLOC_FREE(req);
1392                 return NULL;
1393         }
1394         bytes = smb_bytes_push_str(bytes, false, tmp, strlen(tmp)+1, NULL);
1395         TALLOC_FREE(tmp);
1396
1397         if (bytes == NULL) {
1398                 TALLOC_FREE(req);
1399                 return NULL;
1400         }
1401
1402         state->bytes.iov_base = (void *)bytes;
1403         state->bytes.iov_len = talloc_get_size(bytes);
1404
1405         subreq = cli_smb_req_create(state, ev, cli, SMBtconX, 0, 4, vwv,
1406                                     1, &state->bytes);
1407         if (subreq == NULL) {
1408                 TALLOC_FREE(req);
1409                 return NULL;
1410         }
1411         tevent_req_set_callback(subreq, cli_tcon_andx_done, req);
1412         *psmbreq = subreq;
1413         return req;
1414
1415  access_denied:
1416         tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1417         return tevent_req_post(req, ev);
1418 }
1419
1420 struct tevent_req *cli_tcon_andx_send(TALLOC_CTX *mem_ctx,
1421                                       struct event_context *ev,
1422                                       struct cli_state *cli,
1423                                       const char *share, const char *dev,
1424                                       const char *pass, int passlen)
1425 {
1426         struct tevent_req *req, *subreq;
1427         NTSTATUS status;
1428
1429         req = cli_tcon_andx_create(mem_ctx, ev, cli, share, dev, pass, passlen,
1430                                    &subreq);
1431         if (req == NULL) {
1432                 return NULL;
1433         }
1434         status = cli_smb_req_send(subreq);
1435         if (!NT_STATUS_IS_OK(status)) {
1436                 tevent_req_nterror(req, status);
1437                 return tevent_req_post(req, ev);
1438         }
1439         return req;
1440 }
1441
1442 static void cli_tcon_andx_done(struct tevent_req *subreq)
1443 {
1444         struct tevent_req *req = tevent_req_callback_data(
1445                 subreq, struct tevent_req);
1446         struct cli_tcon_andx_state *state = tevent_req_data(
1447                 req, struct cli_tcon_andx_state);
1448         struct cli_state *cli = state->cli;
1449         char *inbuf = (char *)cli_smb_inbuf(subreq);
1450         uint8_t wct;
1451         uint16_t *vwv;
1452         uint32_t num_bytes;
1453         uint8_t *bytes;
1454         NTSTATUS status;
1455
1456         status = cli_smb_recv(subreq, 0, &wct, &vwv, &num_bytes, &bytes);
1457         if (!NT_STATUS_IS_OK(status)) {
1458                 TALLOC_FREE(subreq);
1459                 tevent_req_nterror(req, status);
1460                 return;
1461         }
1462
1463         clistr_pull(inbuf, cli->dev, bytes, sizeof(fstring), num_bytes,
1464                     STR_TERMINATE|STR_ASCII);
1465
1466         if ((cli->protocol >= PROTOCOL_NT1) && (num_bytes == 3)) {
1467                 /* almost certainly win95 - enable bug fixes */
1468                 cli->win95 = True;
1469         }
1470
1471         /*
1472          * Make sure that we have the optional support 16-bit field. WCT > 2.
1473          * Avoids issues when connecting to Win9x boxes sharing files
1474          */
1475
1476         cli->dfsroot = false;
1477
1478         if ((wct > 2) && (cli->protocol >= PROTOCOL_LANMAN2)) {
1479                 cli->dfsroot = ((SVAL(vwv+2, 0) & SMB_SHARE_IN_DFS) != 0);
1480         }
1481
1482         cli->cnum = SVAL(inbuf,smb_tid);
1483         tevent_req_done(req);
1484 }
1485
1486 NTSTATUS cli_tcon_andx_recv(struct tevent_req *req)
1487 {
1488         return tevent_req_simple_recv_ntstatus(req);
1489 }
1490
1491 NTSTATUS cli_tcon_andx(struct cli_state *cli, const char *share,
1492                        const char *dev, const char *pass, int passlen)
1493 {
1494         TALLOC_CTX *frame = talloc_stackframe();
1495         struct event_context *ev;
1496         struct tevent_req *req;
1497         NTSTATUS status = NT_STATUS_OK;
1498
1499         if (cli_has_async_calls(cli)) {
1500                 /*
1501                  * Can't use sync call while an async call is in flight
1502                  */
1503                 status = NT_STATUS_INVALID_PARAMETER;
1504                 goto fail;
1505         }
1506
1507         ev = event_context_init(frame);
1508         if (ev == NULL) {
1509                 status = NT_STATUS_NO_MEMORY;
1510                 goto fail;
1511         }
1512
1513         req = cli_tcon_andx_send(frame, ev, cli, share, dev, pass, passlen);
1514         if (req == NULL) {
1515                 status = NT_STATUS_NO_MEMORY;
1516                 goto fail;
1517         }
1518
1519         if (!tevent_req_poll(req, ev)) {
1520                 status = map_nt_error_from_unix(errno);
1521                 goto fail;
1522         }
1523
1524         status = cli_tcon_andx_recv(req);
1525  fail:
1526         TALLOC_FREE(frame);
1527         if (!NT_STATUS_IS_OK(status)) {
1528                 cli_set_error(cli, status);
1529         }
1530         return status;
1531 }
1532
1533 /****************************************************************************
1534  Send a tree disconnect.
1535 ****************************************************************************/
1536
1537 bool cli_tdis(struct cli_state *cli)
1538 {
1539         memset(cli->outbuf,'\0',smb_size);
1540         cli_set_message(cli->outbuf,0,0,True);
1541         SCVAL(cli->outbuf,smb_com,SMBtdis);
1542         SSVAL(cli->outbuf,smb_tid,cli->cnum);
1543         cli_setup_packet(cli);
1544
1545         cli_send_smb(cli);
1546         if (!cli_receive_smb(cli))
1547                 return False;
1548
1549         if (cli_is_error(cli)) {
1550                 return False;
1551         }
1552
1553         cli->cnum = -1;
1554         return True;
1555 }
1556
1557 /****************************************************************************
1558  Send a negprot command.
1559 ****************************************************************************/
1560
1561 void cli_negprot_sendsync(struct cli_state *cli)
1562 {
1563         char *p;
1564         int numprots;
1565
1566         if (cli->protocol < PROTOCOL_NT1)
1567                 cli->use_spnego = False;
1568
1569         memset(cli->outbuf,'\0',smb_size);
1570
1571         /* setup the protocol strings */
1572         cli_set_message(cli->outbuf,0,0,True);
1573
1574         p = smb_buf(cli->outbuf);
1575         for (numprots=0; numprots < ARRAY_SIZE(prots); numprots++) {
1576                 if (prots[numprots].prot > cli->protocol) {
1577                         break;
1578                 }
1579                 *p++ = 2;
1580                 p += clistr_push(cli, p, prots[numprots].name, -1, STR_TERMINATE);
1581         }
1582
1583         SCVAL(cli->outbuf,smb_com,SMBnegprot);
1584         cli_setup_bcc(cli, p);
1585         cli_setup_packet(cli);
1586
1587         SCVAL(smb_buf(cli->outbuf),0,2);
1588
1589         cli_send_smb(cli);
1590 }
1591
1592 /****************************************************************************
1593  Send a negprot command.
1594 ****************************************************************************/
1595
1596 struct cli_negprot_state {
1597         struct cli_state *cli;
1598 };
1599
1600 static void cli_negprot_done(struct tevent_req *subreq);
1601
1602 struct tevent_req *cli_negprot_send(TALLOC_CTX *mem_ctx,
1603                                     struct event_context *ev,
1604                                     struct cli_state *cli)
1605 {
1606         struct tevent_req *req, *subreq;
1607         struct cli_negprot_state *state;
1608         uint8_t *bytes = NULL;
1609         int numprots;
1610         uint16_t cnum;
1611
1612         req = tevent_req_create(mem_ctx, &state, struct cli_negprot_state);
1613         if (req == NULL) {
1614                 return NULL;
1615         }
1616         state->cli = cli;
1617
1618         if (cli->protocol < PROTOCOL_NT1)
1619                 cli->use_spnego = False;
1620
1621         /* setup the protocol strings */
1622         for (numprots=0; numprots < ARRAY_SIZE(prots); numprots++) {
1623                 uint8_t c = 2;
1624                 if (prots[numprots].prot > cli->protocol) {
1625                         break;
1626                 }
1627                 bytes = (uint8_t *)talloc_append_blob(
1628                         state, bytes, data_blob_const(&c, sizeof(c)));
1629                 if (tevent_req_nomem(bytes, req)) {
1630                         return tevent_req_post(req, ev);
1631                 }
1632                 bytes = smb_bytes_push_str(bytes, false,
1633                                            prots[numprots].name,
1634                                            strlen(prots[numprots].name)+1,
1635                                            NULL);
1636                 if (tevent_req_nomem(bytes, req)) {
1637                         return tevent_req_post(req, ev);
1638                 }
1639         }
1640
1641         cnum = cli->cnum;
1642
1643         cli->cnum = 0;
1644         subreq = cli_smb_send(state, ev, cli, SMBnegprot, 0, 0, NULL,
1645                               talloc_get_size(bytes), bytes);
1646         cli->cnum = cnum;
1647
1648         if (tevent_req_nomem(subreq, req)) {
1649                 return tevent_req_post(req, ev);
1650         }
1651         tevent_req_set_callback(subreq, cli_negprot_done, req);
1652         return req;
1653 }
1654
1655 static void cli_negprot_done(struct tevent_req *subreq)
1656 {
1657         struct tevent_req *req = tevent_req_callback_data(
1658                 subreq, struct tevent_req);
1659         struct cli_negprot_state *state = tevent_req_data(
1660                 req, struct cli_negprot_state);
1661         struct cli_state *cli = state->cli;
1662         uint8_t wct;
1663         uint16_t *vwv;
1664         uint32_t num_bytes;
1665         uint8_t *bytes;
1666         NTSTATUS status;
1667         uint16_t protnum;
1668
1669         status = cli_smb_recv(subreq, 1, &wct, &vwv, &num_bytes, &bytes);
1670         if (!NT_STATUS_IS_OK(status)) {
1671                 TALLOC_FREE(subreq);
1672                 return;
1673         }
1674
1675         protnum = SVAL(vwv, 0);
1676
1677         if ((protnum >= ARRAY_SIZE(prots))
1678             || (prots[protnum].prot > cli->protocol)) {
1679                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1680                 return;
1681         }
1682
1683         cli->protocol = prots[protnum].prot;
1684
1685         if ((cli->protocol < PROTOCOL_NT1) &&
1686             client_is_signing_mandatory(cli)) {
1687                 DEBUG(0,("cli_negprot: SMB signing is mandatory and the selected protocol level doesn't support it.\n"));
1688                 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1689                 return;
1690         }
1691
1692         if (cli->protocol >= PROTOCOL_NT1) {
1693                 struct timespec ts;
1694                 bool negotiated_smb_signing = false;
1695
1696                 /* NT protocol */
1697                 cli->sec_mode = CVAL(vwv + 1, 0);
1698                 cli->max_mux = SVAL(vwv + 1, 1);
1699                 cli->max_xmit = IVAL(vwv + 3, 1);
1700                 cli->sesskey = IVAL(vwv + 7, 1);
1701                 cli->serverzone = SVALS(vwv + 15, 1);
1702                 cli->serverzone *= 60;
1703                 /* this time arrives in real GMT */
1704                 ts = interpret_long_date(((char *)(vwv+11))+1);
1705                 cli->servertime = ts.tv_sec;
1706                 cli->secblob = data_blob(bytes, num_bytes);
1707                 cli->capabilities = IVAL(vwv + 9, 1);
1708                 if (cli->capabilities & CAP_RAW_MODE) {
1709                         cli->readbraw_supported = True;
1710                         cli->writebraw_supported = True;
1711                 }
1712                 /* work out if they sent us a workgroup */
1713                 if (!(cli->capabilities & CAP_EXTENDED_SECURITY) &&
1714                     smb_buflen(cli->inbuf) > 8) {
1715                         clistr_pull(cli->inbuf, cli->server_domain,
1716                                     bytes+8, sizeof(cli->server_domain),
1717                                     num_bytes-8,
1718                                     STR_UNICODE|STR_NOALIGN);
1719                 }
1720
1721                 /*
1722                  * As signing is slow we only turn it on if either the client or
1723                  * the server require it. JRA.
1724                  */
1725
1726                 if (cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED) {
1727                         /* Fail if server says signing is mandatory and we don't want to support it. */
1728                         if (!client_is_signing_allowed(cli)) {
1729                                 DEBUG(0,("cli_negprot: SMB signing is mandatory and we have disabled it.\n"));
1730                                 tevent_req_nterror(req,
1731                                                    NT_STATUS_ACCESS_DENIED);
1732                                 return;
1733                         }
1734                         negotiated_smb_signing = true;
1735                 } else if (client_is_signing_mandatory(cli) && client_is_signing_allowed(cli)) {
1736                         /* Fail if client says signing is mandatory and the server doesn't support it. */
1737                         if (!(cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED)) {
1738                                 DEBUG(1,("cli_negprot: SMB signing is mandatory and the server doesn't support it.\n"));
1739                                 tevent_req_nterror(req,
1740                                                    NT_STATUS_ACCESS_DENIED);
1741                                 return;
1742                         }
1743                         negotiated_smb_signing = true;
1744                 } else if (cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED) {
1745                         negotiated_smb_signing = true;
1746                 }
1747
1748                 if (negotiated_smb_signing) {
1749                         cli_set_signing_negotiated(cli);
1750                 }
1751
1752                 if (cli->capabilities & (CAP_LARGE_READX|CAP_LARGE_WRITEX)) {
1753                         SAFE_FREE(cli->outbuf);
1754                         SAFE_FREE(cli->inbuf);
1755                         cli->outbuf = (char *)SMB_MALLOC(CLI_SAMBA_MAX_LARGE_READX_SIZE+LARGE_WRITEX_HDR_SIZE+SAFETY_MARGIN);
1756                         cli->inbuf = (char *)SMB_MALLOC(CLI_SAMBA_MAX_LARGE_READX_SIZE+LARGE_WRITEX_HDR_SIZE+SAFETY_MARGIN);
1757                         cli->bufsize = CLI_SAMBA_MAX_LARGE_READX_SIZE + LARGE_WRITEX_HDR_SIZE;
1758                 }
1759
1760         } else if (cli->protocol >= PROTOCOL_LANMAN1) {
1761                 cli->use_spnego = False;
1762                 cli->sec_mode = SVAL(vwv + 1, 0);
1763                 cli->max_xmit = SVAL(vwv + 2, 0);
1764                 cli->max_mux = SVAL(vwv + 3, 0);
1765                 cli->sesskey = IVAL(vwv + 6, 0);
1766                 cli->serverzone = SVALS(vwv + 10, 0);
1767                 cli->serverzone *= 60;
1768                 /* this time is converted to GMT by make_unix_date */
1769                 cli->servertime = cli_make_unix_date(
1770                         cli, (char *)(vwv + 8));
1771                 cli->readbraw_supported = ((SVAL(vwv + 5, 0) & 0x1) != 0);
1772                 cli->writebraw_supported = ((SVAL(vwv + 5, 0) & 0x2) != 0);
1773                 cli->secblob = data_blob(bytes, num_bytes);
1774         } else {
1775                 /* the old core protocol */
1776                 cli->use_spnego = False;
1777                 cli->sec_mode = 0;
1778                 cli->serverzone = get_time_zone(time(NULL));
1779         }
1780
1781         cli->max_xmit = MIN(cli->max_xmit, CLI_BUFFER_SIZE);
1782
1783         /* a way to force ascii SMB */
1784         if (getenv("CLI_FORCE_ASCII"))
1785                 cli->capabilities &= ~CAP_UNICODE;
1786
1787         tevent_req_done(req);
1788 }
1789
1790 NTSTATUS cli_negprot_recv(struct tevent_req *req)
1791 {
1792         return tevent_req_simple_recv_ntstatus(req);
1793 }
1794
1795 NTSTATUS cli_negprot(struct cli_state *cli)
1796 {
1797         TALLOC_CTX *frame = talloc_stackframe();
1798         struct event_context *ev;
1799         struct tevent_req *req;
1800         NTSTATUS status = NT_STATUS_OK;
1801
1802         if (cli_has_async_calls(cli)) {
1803                 /*
1804                  * Can't use sync call while an async call is in flight
1805                  */
1806                 status = NT_STATUS_INVALID_PARAMETER;
1807                 goto fail;
1808         }
1809
1810         ev = event_context_init(frame);
1811         if (ev == NULL) {
1812                 status = NT_STATUS_NO_MEMORY;
1813                 goto fail;
1814         }
1815
1816         req = cli_negprot_send(frame, ev, cli);
1817         if (req == NULL) {
1818                 status = NT_STATUS_NO_MEMORY;
1819                 goto fail;
1820         }
1821
1822         if (!tevent_req_poll(req, ev)) {
1823                 status = map_nt_error_from_unix(errno);
1824                 goto fail;
1825         }
1826
1827         status = cli_negprot_recv(req);
1828  fail:
1829         TALLOC_FREE(frame);
1830         if (!NT_STATUS_IS_OK(status)) {
1831                 cli_set_error(cli, status);
1832         }
1833         return status;
1834 }
1835
1836 /****************************************************************************
1837  Send a session request. See rfc1002.txt 4.3 and 4.3.2.
1838 ****************************************************************************/
1839
1840 bool cli_session_request(struct cli_state *cli,
1841                          struct nmb_name *calling, struct nmb_name *called)
1842 {
1843         char *p;
1844         int len = 4;
1845         char *tmp;
1846
1847         /* 445 doesn't have session request */
1848         if (cli->port == 445)
1849                 return True;
1850
1851         memcpy(&(cli->calling), calling, sizeof(*calling));
1852         memcpy(&(cli->called ), called , sizeof(*called ));
1853
1854         /* put in the destination name */
1855
1856         tmp = name_mangle(talloc_tos(), cli->called.name,
1857                           cli->called.name_type);
1858         if (tmp == NULL) {
1859                 return false;
1860         }
1861
1862         p = cli->outbuf+len;
1863         memcpy(p, tmp, name_len(tmp));
1864         len += name_len(tmp);
1865         TALLOC_FREE(tmp);
1866
1867         /* and my name */
1868
1869         tmp = name_mangle(talloc_tos(), cli->calling.name,
1870                           cli->calling.name_type);
1871         if (tmp == NULL) {
1872                 return false;
1873         }
1874
1875         p = cli->outbuf+len;
1876         memcpy(p, tmp, name_len(tmp));
1877         len += name_len(tmp);
1878         TALLOC_FREE(tmp);
1879
1880         /* send a session request (RFC 1002) */
1881         /* setup the packet length
1882          * Remove four bytes from the length count, since the length
1883          * field in the NBT Session Service header counts the number
1884          * of bytes which follow.  The cli_send_smb() function knows
1885          * about this and accounts for those four bytes.
1886          * CRH.
1887          */
1888         len -= 4;
1889         _smb_setlen(cli->outbuf,len);
1890         SCVAL(cli->outbuf,0,0x81);
1891
1892         cli_send_smb(cli);
1893         DEBUG(5,("Sent session request\n"));
1894
1895         if (!cli_receive_smb(cli))
1896                 return False;
1897
1898         if (CVAL(cli->inbuf,0) == 0x84) {
1899                 /* C. Hoch  9/14/95 Start */
1900                 /* For information, here is the response structure.
1901                  * We do the byte-twiddling to for portability.
1902                 struct RetargetResponse{
1903                 unsigned char type;
1904                 unsigned char flags;
1905                 int16 length;
1906                 int32 ip_addr;
1907                 int16 port;
1908                 };
1909                 */
1910                 uint16_t port = (CVAL(cli->inbuf,8)<<8)+CVAL(cli->inbuf,9);
1911                 struct in_addr dest_ip;
1912                 NTSTATUS status;
1913
1914                 /* SESSION RETARGET */
1915                 putip((char *)&dest_ip,cli->inbuf+4);
1916                 in_addr_to_sockaddr_storage(&cli->dest_ss, dest_ip);
1917
1918                 status = open_socket_out(&cli->dest_ss, port,
1919                                          LONG_CONNECT_TIMEOUT, &cli->fd);
1920                 if (!NT_STATUS_IS_OK(status)) {
1921                         return False;
1922                 }
1923
1924                 DEBUG(3,("Retargeted\n"));
1925
1926                 set_socket_options(cli->fd, lp_socket_options());
1927
1928                 /* Try again */
1929                 {
1930                         static int depth;
1931                         bool ret;
1932                         if (depth > 4) {
1933                                 DEBUG(0,("Retarget recursion - failing\n"));
1934                                 return False;
1935                         }
1936                         depth++;
1937                         ret = cli_session_request(cli, calling, called);
1938                         depth--;
1939                         return ret;
1940                 }
1941         } /* C. Hoch 9/14/95 End */
1942
1943         if (CVAL(cli->inbuf,0) != 0x82) {
1944                 /* This is the wrong place to put the error... JRA. */
1945                 cli->rap_error = CVAL(cli->inbuf,4);
1946                 return False;
1947         }
1948         return(True);
1949 }
1950
1951 struct fd_struct {
1952         int fd;
1953 };
1954
1955 static void smb_sock_connected(struct tevent_req *req)
1956 {
1957         struct fd_struct *pfd = tevent_req_callback_data(
1958                 req, struct fd_struct);
1959         int fd;
1960         NTSTATUS status;
1961
1962         status = open_socket_out_defer_recv(req, &fd);
1963         if (NT_STATUS_IS_OK(status)) {
1964                 pfd->fd = fd;
1965         }
1966 }
1967
1968 static NTSTATUS open_smb_socket(const struct sockaddr_storage *pss,
1969                                 uint16_t *port, int timeout, int *pfd)
1970 {
1971         struct event_context *ev;
1972         struct tevent_req *r139, *r445;
1973         struct fd_struct *fd139, *fd445;
1974         NTSTATUS status = NT_STATUS_NO_MEMORY;
1975
1976         if (*port != 0) {
1977                 return open_socket_out(pss, *port, timeout, pfd);
1978         }
1979
1980         ev = event_context_init(talloc_tos());
1981         if (ev == NULL) {
1982                 return NT_STATUS_NO_MEMORY;
1983         }
1984
1985         fd139 = talloc(ev, struct fd_struct);
1986         if (fd139 == NULL) {
1987                 goto done;
1988         }
1989         fd139->fd = -1;
1990
1991         fd445 = talloc(ev, struct fd_struct);
1992         if (fd445 == NULL) {
1993                 goto done;
1994         }
1995         fd445->fd = -1;
1996
1997         r445 = open_socket_out_defer_send(ev, ev, timeval_set(0, 0),
1998                                           pss, 445, timeout);
1999         r139 = open_socket_out_defer_send(ev, ev, timeval_set(0, 3000),
2000                                           pss, 139, timeout);
2001         if ((r445 == NULL) || (r139 == NULL)) {
2002                 goto done;
2003         }
2004         tevent_req_set_callback(r445, smb_sock_connected, fd445);
2005         tevent_req_set_callback(r139, smb_sock_connected, fd139);
2006
2007         while ((fd445->fd == -1) && (fd139->fd == -1)
2008                && (tevent_req_is_in_progress(r139)
2009                    || tevent_req_is_in_progress(r445))) {
2010                 event_loop_once(ev);
2011         }
2012
2013         if ((fd139->fd != -1) && (fd445->fd != -1)) {
2014                 close(fd139->fd);
2015                 fd139->fd = -1;
2016         }
2017
2018         if (fd445->fd != -1) {
2019                 *port = 445;
2020                 *pfd = fd445->fd;
2021                 status = NT_STATUS_OK;
2022                 goto done;
2023         }
2024         if (fd139->fd != -1) {
2025                 *port = 139;
2026                 *pfd = fd139->fd;
2027                 status = NT_STATUS_OK;
2028                 goto done;
2029         }
2030
2031         status = open_socket_out_defer_recv(r445, &fd445->fd);
2032  done:
2033         TALLOC_FREE(ev);
2034         return status;
2035 }
2036
2037 /****************************************************************************
2038  Open the client sockets.
2039 ****************************************************************************/
2040
2041 NTSTATUS cli_connect(struct cli_state *cli,
2042                 const char *host,
2043                 struct sockaddr_storage *dest_ss)
2044
2045 {
2046         int name_type = 0x20;
2047         TALLOC_CTX *frame = talloc_stackframe();
2048         unsigned int num_addrs = 0;
2049         unsigned int i = 0;
2050         struct sockaddr_storage *ss_arr = NULL;
2051         char *p = NULL;
2052
2053         /* reasonable default hostname */
2054         if (!host) {
2055                 host = STAR_SMBSERVER;
2056         }
2057
2058         fstrcpy(cli->desthost, host);
2059
2060         /* allow hostnames of the form NAME#xx and do a netbios lookup */
2061         if ((p = strchr(cli->desthost, '#'))) {
2062                 name_type = strtol(p+1, NULL, 16);
2063                 *p = 0;
2064         }
2065
2066         if (!dest_ss || is_zero_addr((struct sockaddr *)dest_ss)) {
2067                 NTSTATUS status =resolve_name_list(frame,
2068                                         cli->desthost,
2069                                         name_type,
2070                                         &ss_arr,
2071                                         &num_addrs);
2072                 if (!NT_STATUS_IS_OK(status)) {
2073                         TALLOC_FREE(frame);
2074                         return NT_STATUS_BAD_NETWORK_NAME;
2075                 }
2076         } else {
2077                 num_addrs = 1;
2078                 ss_arr = TALLOC_P(frame, struct sockaddr_storage);
2079                 if (!ss_arr) {
2080                         TALLOC_FREE(frame);
2081                         return NT_STATUS_NO_MEMORY;
2082                 }
2083                 *ss_arr = *dest_ss;
2084         }
2085
2086         for (i = 0; i < num_addrs; i++) {
2087                 cli->dest_ss = ss_arr[i];
2088                 if (getenv("LIBSMB_PROG")) {
2089                         cli->fd = sock_exec(getenv("LIBSMB_PROG"));
2090                 } else {
2091                         uint16_t port = cli->port;
2092                         NTSTATUS status;
2093                         status = open_smb_socket(&cli->dest_ss, &port,
2094                                                  cli->timeout, &cli->fd);
2095                         if (NT_STATUS_IS_OK(status)) {
2096                                 cli->port = port;
2097                         }
2098                 }
2099                 if (cli->fd == -1) {
2100                         char addr[INET6_ADDRSTRLEN];
2101                         print_sockaddr(addr, sizeof(addr), &ss_arr[i]);
2102                         DEBUG(2,("Error connecting to %s (%s)\n",
2103                                  dest_ss?addr:host,strerror(errno)));
2104                 } else {
2105                         /* Exit from loop on first connection. */
2106                         break;
2107                 }
2108         }
2109
2110         if (cli->fd == -1) {
2111                 TALLOC_FREE(frame);
2112                 return map_nt_error_from_unix(errno);
2113         }
2114
2115         if (dest_ss) {
2116                 *dest_ss = cli->dest_ss;
2117         }
2118
2119         set_socket_options(cli->fd, lp_socket_options());
2120
2121         TALLOC_FREE(frame);
2122         return NT_STATUS_OK;
2123 }
2124
2125 /**
2126    establishes a connection to after the negprot.
2127    @param output_cli A fully initialised cli structure, non-null only on success
2128    @param dest_host The netbios name of the remote host
2129    @param dest_ss (optional) The the destination IP, NULL for name based lookup
2130    @param port (optional) The destination port (0 for default)
2131    @param retry bool. Did this connection fail with a retryable error ?
2132
2133 */
2134 NTSTATUS cli_start_connection(struct cli_state **output_cli,
2135                               const char *my_name,
2136                               const char *dest_host,
2137                               struct sockaddr_storage *dest_ss, int port,
2138                               int signing_state, int flags,
2139                               bool *retry)
2140 {
2141         NTSTATUS nt_status;
2142         struct nmb_name calling;
2143         struct nmb_name called;
2144         struct cli_state *cli;
2145         struct sockaddr_storage ss;
2146
2147         if (retry)
2148                 *retry = False;
2149
2150         if (!my_name)
2151                 my_name = global_myname();
2152
2153         if (!(cli = cli_initialise_ex(signing_state))) {
2154                 return NT_STATUS_NO_MEMORY;
2155         }
2156
2157         make_nmb_name(&calling, my_name, 0x0);
2158         make_nmb_name(&called , dest_host, 0x20);
2159
2160         cli_set_port(cli, port);
2161         cli_set_timeout(cli, 10000); /* 10 seconds. */
2162
2163         if (dest_ss) {
2164                 ss = *dest_ss;
2165         } else {
2166                 zero_sockaddr(&ss);
2167         }
2168
2169 again:
2170
2171         DEBUG(3,("Connecting to host=%s\n", dest_host));
2172
2173         nt_status = cli_connect(cli, dest_host, &ss);
2174         if (!NT_STATUS_IS_OK(nt_status)) {
2175                 char addr[INET6_ADDRSTRLEN];
2176                 print_sockaddr(addr, sizeof(addr), &ss);
2177                 DEBUG(1,("cli_start_connection: failed to connect to %s (%s). Error %s\n",
2178                          nmb_namestr(&called), addr, nt_errstr(nt_status) ));
2179                 cli_shutdown(cli);
2180                 return nt_status;
2181         }
2182
2183         if (retry)
2184                 *retry = True;
2185
2186         if (!cli_session_request(cli, &calling, &called)) {
2187                 char *p;
2188                 DEBUG(1,("session request to %s failed (%s)\n",
2189                          called.name, cli_errstr(cli)));
2190                 if ((p=strchr(called.name, '.')) && !is_ipaddress(called.name)) {
2191                         *p = 0;
2192                         goto again;
2193                 }
2194                 if (strcmp(called.name, STAR_SMBSERVER)) {
2195                         make_nmb_name(&called , STAR_SMBSERVER, 0x20);
2196                         goto again;
2197                 }
2198                 return NT_STATUS_BAD_NETWORK_NAME;
2199         }
2200
2201         if (flags & CLI_FULL_CONNECTION_DONT_SPNEGO)
2202                 cli->use_spnego = False;
2203         else if (flags & CLI_FULL_CONNECTION_USE_KERBEROS)
2204                 cli->use_kerberos = True;
2205
2206         if ((flags & CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS) &&
2207              cli->use_kerberos) {
2208                 cli->fallback_after_kerberos = true;
2209         }
2210
2211         nt_status = cli_negprot(cli);
2212         if (!NT_STATUS_IS_OK(nt_status)) {
2213                 DEBUG(1, ("failed negprot: %s\n", nt_errstr(nt_status)));
2214                 cli_shutdown(cli);
2215                 return nt_status;
2216         }
2217
2218         *output_cli = cli;
2219         return NT_STATUS_OK;
2220 }
2221
2222
2223 /**
2224    establishes a connection right up to doing tconX, password specified.
2225    @param output_cli A fully initialised cli structure, non-null only on success
2226    @param dest_host The netbios name of the remote host
2227    @param dest_ip (optional) The the destination IP, NULL for name based lookup
2228    @param port (optional) The destination port (0 for default)
2229    @param service (optional) The share to make the connection to.  Should be 'unqualified' in any way.
2230    @param service_type The 'type' of serivice.
2231    @param user Username, unix string
2232    @param domain User's domain
2233    @param password User's password, unencrypted unix string.
2234    @param retry bool. Did this connection fail with a retryable error ?
2235 */
2236
2237 NTSTATUS cli_full_connection(struct cli_state **output_cli,
2238                              const char *my_name,
2239                              const char *dest_host,
2240                              struct sockaddr_storage *dest_ss, int port,
2241                              const char *service, const char *service_type,
2242                              const char *user, const char *domain,
2243                              const char *password, int flags,
2244                              int signing_state,
2245                              bool *retry)
2246 {
2247         NTSTATUS nt_status;
2248         struct cli_state *cli = NULL;
2249         int pw_len = password ? strlen(password)+1 : 0;
2250
2251         *output_cli = NULL;
2252
2253         if (password == NULL) {
2254                 password = "";
2255         }
2256
2257         nt_status = cli_start_connection(&cli, my_name, dest_host,
2258                                          dest_ss, port, signing_state,
2259                                          flags, retry);
2260
2261         if (!NT_STATUS_IS_OK(nt_status)) {
2262                 return nt_status;
2263         }
2264
2265         cli->use_oplocks = ((flags & CLI_FULL_CONNECTION_OPLOCKS) != 0);
2266         cli->use_level_II_oplocks =
2267                 ((flags & CLI_FULL_CONNECTION_LEVEL_II_OPLOCKS) != 0);
2268
2269         nt_status = cli_session_setup(cli, user, password, pw_len, password,
2270                                       pw_len, domain);
2271         if (!NT_STATUS_IS_OK(nt_status)) {
2272
2273                 if (!(flags & CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK)) {
2274                         DEBUG(1,("failed session setup with %s\n",
2275                                  nt_errstr(nt_status)));
2276                         cli_shutdown(cli);
2277                         return nt_status;
2278                 }
2279
2280                 nt_status = cli_session_setup(cli, "", "", 0, "", 0, domain);
2281                 if (!NT_STATUS_IS_OK(nt_status)) {
2282                         DEBUG(1,("anonymous failed session setup with %s\n",
2283                                  nt_errstr(nt_status)));
2284                         cli_shutdown(cli);
2285                         return nt_status;
2286                 }
2287         }
2288
2289         if (service) {
2290                 nt_status = cli_tcon_andx(cli, service, service_type, password,
2291                                           pw_len);
2292                 if (!NT_STATUS_IS_OK(nt_status)) {
2293                         DEBUG(1,("failed tcon_X with %s\n", nt_errstr(nt_status)));
2294                         cli_shutdown(cli);
2295                         if (NT_STATUS_IS_OK(nt_status)) {
2296                                 nt_status = NT_STATUS_UNSUCCESSFUL;
2297                         }
2298                         return nt_status;
2299                 }
2300         }
2301
2302         nt_status = cli_init_creds(cli, user, domain, password);
2303         if (!NT_STATUS_IS_OK(nt_status)) {
2304                 cli_shutdown(cli);
2305                 return nt_status;
2306         }
2307
2308         *output_cli = cli;
2309         return NT_STATUS_OK;
2310 }
2311
2312 /****************************************************************************
2313  Attempt a NetBIOS session request, falling back to *SMBSERVER if needed.
2314 ****************************************************************************/
2315
2316 bool attempt_netbios_session_request(struct cli_state **ppcli, const char *srchost, const char *desthost,
2317                                      struct sockaddr_storage *pdest_ss)
2318 {
2319         struct nmb_name calling, called;
2320
2321         make_nmb_name(&calling, srchost, 0x0);
2322
2323         /*
2324          * If the called name is an IP address
2325          * then use *SMBSERVER immediately.
2326          */
2327
2328         if(is_ipaddress(desthost)) {
2329                 make_nmb_name(&called, STAR_SMBSERVER, 0x20);
2330         } else {
2331                 make_nmb_name(&called, desthost, 0x20);
2332         }
2333
2334         if (!cli_session_request(*ppcli, &calling, &called)) {
2335                 NTSTATUS status;
2336                 struct nmb_name smbservername;
2337
2338                 make_nmb_name(&smbservername, STAR_SMBSERVER, 0x20);
2339
2340                 /*
2341                  * If the name wasn't *SMBSERVER then
2342                  * try with *SMBSERVER if the first name fails.
2343                  */
2344
2345                 if (nmb_name_equal(&called, &smbservername)) {
2346
2347                         /*
2348                          * The name used was *SMBSERVER, don't bother with another name.
2349                          */
2350
2351                         DEBUG(0,("attempt_netbios_session_request: %s rejected the session for name *SMBSERVER \
2352 with error %s.\n", desthost, cli_errstr(*ppcli) ));
2353                         return False;
2354                 }
2355
2356                 /* Try again... */
2357                 cli_shutdown(*ppcli);
2358
2359                 *ppcli = cli_initialise();
2360                 if (!*ppcli) {
2361                         /* Out of memory... */
2362                         return False;
2363                 }
2364
2365                 status = cli_connect(*ppcli, desthost, pdest_ss);
2366                 if (!NT_STATUS_IS_OK(status) ||
2367                                 !cli_session_request(*ppcli, &calling, &smbservername)) {
2368                         DEBUG(0,("attempt_netbios_session_request: %s rejected the session for \
2369 name *SMBSERVER with error %s\n", desthost, cli_errstr(*ppcli) ));
2370                         return False;
2371                 }
2372         }
2373
2374         return True;
2375 }
2376
2377 /****************************************************************************
2378  Send an old style tcon.
2379 ****************************************************************************/
2380 NTSTATUS cli_raw_tcon(struct cli_state *cli,
2381                       const char *service, const char *pass, const char *dev,
2382                       uint16 *max_xmit, uint16 *tid)
2383 {
2384         char *p;
2385
2386         if (!lp_client_plaintext_auth() && (*pass)) {
2387                 DEBUG(1, ("Server requested plaintext password but 'client "
2388                           "plaintext auth' is disabled\n"));
2389                 return NT_STATUS_ACCESS_DENIED;
2390         }
2391
2392         memset(cli->outbuf,'\0',smb_size);
2393         memset(cli->inbuf,'\0',smb_size);
2394
2395         cli_set_message(cli->outbuf, 0, 0, True);
2396         SCVAL(cli->outbuf,smb_com,SMBtcon);
2397         cli_setup_packet(cli);
2398
2399         p = smb_buf(cli->outbuf);
2400         *p++ = 4; p += clistr_push(cli, p, service, -1, STR_TERMINATE | STR_NOALIGN);
2401         *p++ = 4; p += clistr_push(cli, p, pass, -1, STR_TERMINATE | STR_NOALIGN);
2402         *p++ = 4; p += clistr_push(cli, p, dev, -1, STR_TERMINATE | STR_NOALIGN);
2403
2404         cli_setup_bcc(cli, p);
2405
2406         cli_send_smb(cli);
2407         if (!cli_receive_smb(cli)) {
2408                 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
2409         }
2410
2411         if (cli_is_error(cli)) {
2412                 return cli_nt_error(cli);
2413         }
2414
2415         *max_xmit = SVAL(cli->inbuf, smb_vwv0);
2416         *tid = SVAL(cli->inbuf, smb_vwv1);
2417
2418         return NT_STATUS_OK;
2419 }
2420
2421 /* Return a cli_state pointing at the IPC$ share for the given server */
2422
2423 struct cli_state *get_ipc_connect(char *server,
2424                                 struct sockaddr_storage *server_ss,
2425                                 const struct user_auth_info *user_info)
2426 {
2427         struct cli_state *cli;
2428         NTSTATUS nt_status;
2429         uint32_t flags = CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK;
2430
2431         if (user_info->use_kerberos) {
2432                 flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
2433         }
2434
2435         nt_status = cli_full_connection(&cli, NULL, server, server_ss, 0, "IPC$", "IPC",
2436                                         user_info->username ? user_info->username : "",
2437                                         lp_workgroup(),
2438                                         user_info->password ? user_info->password : "",
2439                                         flags,
2440                                         Undefined, NULL);
2441
2442         if (NT_STATUS_IS_OK(nt_status)) {
2443                 return cli;
2444         } else if (is_ipaddress(server)) {
2445             /* windows 9* needs a correct NMB name for connections */
2446             fstring remote_name;
2447
2448             if (name_status_find("*", 0, 0, server_ss, remote_name)) {
2449                 cli = get_ipc_connect(remote_name, server_ss, user_info);
2450                 if (cli)
2451                     return cli;
2452             }
2453         }
2454         return NULL;
2455 }
2456
2457 /*
2458  * Given the IP address of a master browser on the network, return its
2459  * workgroup and connect to it.
2460  *
2461  * This function is provided to allow additional processing beyond what
2462  * get_ipc_connect_master_ip_bcast() does, e.g. to retrieve the list of master
2463  * browsers and obtain each master browsers' list of domains (in case the
2464  * first master browser is recently on the network and has not yet
2465  * synchronized with other master browsers and therefore does not yet have the
2466  * entire network browse list)
2467  */
2468
2469 struct cli_state *get_ipc_connect_master_ip(TALLOC_CTX *ctx,
2470                                 struct ip_service *mb_ip,
2471                                 const struct user_auth_info *user_info,
2472                                 char **pp_workgroup_out)
2473 {
2474         char addr[INET6_ADDRSTRLEN];
2475         fstring name;
2476         struct cli_state *cli;
2477         struct sockaddr_storage server_ss;
2478
2479         *pp_workgroup_out = NULL;
2480
2481         print_sockaddr(addr, sizeof(addr), &mb_ip->ss);
2482         DEBUG(99, ("Looking up name of master browser %s\n",
2483                    addr));
2484
2485         /*
2486          * Do a name status query to find out the name of the master browser.
2487          * We use <01><02>__MSBROWSE__<02>#01 if *#00 fails because a domain
2488          * master browser will not respond to a wildcard query (or, at least,
2489          * an NT4 server acting as the domain master browser will not).
2490          *
2491          * We might be able to use ONLY the query on MSBROWSE, but that's not
2492          * yet been tested with all Windows versions, so until it is, leave
2493          * the original wildcard query as the first choice and fall back to
2494          * MSBROWSE if the wildcard query fails.
2495          */
2496         if (!name_status_find("*", 0, 0x1d, &mb_ip->ss, name) &&
2497             !name_status_find(MSBROWSE, 1, 0x1d, &mb_ip->ss, name)) {
2498
2499                 DEBUG(99, ("Could not retrieve name status for %s\n",
2500                            addr));
2501                 return NULL;
2502         }
2503
2504         if (!find_master_ip(name, &server_ss)) {
2505                 DEBUG(99, ("Could not find master ip for %s\n", name));
2506                 return NULL;
2507         }
2508
2509         *pp_workgroup_out = talloc_strdup(ctx, name);
2510
2511         DEBUG(4, ("found master browser %s, %s\n", name, addr));
2512
2513         print_sockaddr(addr, sizeof(addr), &server_ss);
2514         cli = get_ipc_connect(addr, &server_ss, user_info);
2515
2516         return cli;
2517 }
2518
2519 /*
2520  * Return the IP address and workgroup of a master browser on the network, and
2521  * connect to it.
2522  */
2523
2524 struct cli_state *get_ipc_connect_master_ip_bcast(TALLOC_CTX *ctx,
2525                                         const struct user_auth_info *user_info,
2526                                         char **pp_workgroup_out)
2527 {
2528         struct ip_service *ip_list;
2529         struct cli_state *cli;
2530         int i, count;
2531
2532         *pp_workgroup_out = NULL;
2533
2534         DEBUG(99, ("Do broadcast lookup for workgroups on local network\n"));
2535
2536         /* Go looking for workgroups by broadcasting on the local network */
2537
2538         if (!NT_STATUS_IS_OK(name_resolve_bcast(MSBROWSE, 1, &ip_list,
2539                                                 &count))) {
2540                 DEBUG(99, ("No master browsers responded\n"));
2541                 return False;
2542         }
2543
2544         for (i = 0; i < count; i++) {
2545                 char addr[INET6_ADDRSTRLEN];
2546                 print_sockaddr(addr, sizeof(addr), &ip_list[i].ss);
2547                 DEBUG(99, ("Found master browser %s\n", addr));
2548
2549                 cli = get_ipc_connect_master_ip(ctx, &ip_list[i],
2550                                 user_info, pp_workgroup_out);
2551                 if (cli)
2552                         return(cli);
2553         }
2554
2555         return NULL;
2556 }