source3/libsmb/cliconnect.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    client connect/disconnect routines
   4    Copyright (C) Andrew Tridgell 1994-1998
   5    Copyright (C) Andrew Bartlett 2001-2003
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 2 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program; if not, write to the Free Software
  19    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20 */
  21
  22 #include "includes.h"
  23
  24 extern pstring user_socket_options;
  25
  26 static const struct {
  27         int prot;
  28         const char *name;
  29 } prots[] = {
  30         {PROTOCOL_CORE,"PC NETWORK PROGRAM 1.0"},
  31         {PROTOCOL_COREPLUS,"MICROSOFT NETWORKS 1.03"},
  32         {PROTOCOL_LANMAN1,"MICROSOFT NETWORKS 3.0"},
  33         {PROTOCOL_LANMAN1,"LANMAN1.0"},
  34         {PROTOCOL_LANMAN2,"LM1.2X002"},
  35         {PROTOCOL_LANMAN2,"DOS LANMAN2.1"},
  36         {PROTOCOL_LANMAN2,"LANMAN2.1"},
  37         {PROTOCOL_LANMAN2,"Samba"},
  38         {PROTOCOL_NT1,"NT LANMAN 1.0"},
  39         {PROTOCOL_NT1,"NT LM 0.12"},
  40         {-1,NULL}
  41 };
  42
  43 /**
  44  * Set the user session key for a connection
  45  * @param cli The cli structure to add it too
  46  * @param session_key The session key used.  (A copy of this is taken for the cli struct)
  47  *
  48  */
  49
  50 static void cli_set_session_key (struct cli_state *cli, const DATA_BLOB session_key)
  51 {
  52         cli->user_session_key = data_blob(session_key.data, session_key.length);
  53 }
  54
  55 /****************************************************************************
  56  Do an old lanman2 style session setup.
  57 ****************************************************************************/
  58
  59 static NTSTATUS cli_session_setup_lanman2(struct cli_state *cli,
  60                                           const char *user,
  61                                           const char *pass, size_t passlen,
  62                                           const char *workgroup)
  63 {
  64         DATA_BLOB session_key = data_blob_null;
  65         DATA_BLOB lm_response = data_blob_null;
  66         fstring pword;
  67         char *p;
  68
  69         if (passlen > sizeof(pword)-1) {
  70                 return NT_STATUS_INVALID_PARAMETER;
  71         }
  72
  73         /* LANMAN servers predate NT status codes and Unicode and ignore those
  74            smb flags so we must disable the corresponding default capabilities
  75            that would otherwise cause the Unicode and NT Status flags to be
  76            set (and even returned by the server) */
  77
  78         cli->capabilities &= ~(CAP_UNICODE | CAP_STATUS32);
  79
  80         /* if in share level security then don't send a password now */
  81         if (!(cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL))
  82                 passlen = 0;
  83
  84         if (passlen > 0 && (cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) && passlen != 24) {
  85                 /* Encrypted mode needed, and non encrypted password supplied. */
  86                 lm_response = data_blob(NULL, 24);
  87                 if (!SMBencrypt(pass, cli->secblob.data,(uchar *)lm_response.data)) {
  88                         DEBUG(1, ("Password is > 14 chars in length, and is therefore incompatible with Lanman authentication\n"));
  89                         return NT_STATUS_ACCESS_DENIED;
  90                 }
  91         } else if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) && passlen == 24) {
  92                 /* Encrypted mode needed, and encrypted password supplied. */
  93                 lm_response = data_blob(pass, passlen);
  94         } else if (passlen > 0) {
  95                 /* Plaintext mode needed, assume plaintext supplied. */
  96                 passlen = clistr_push(cli, pword, pass, sizeof(pword), STR_TERMINATE);
  97                 lm_response = data_blob(pass, passlen);
  98         }
  99
 100         /* send a session setup command */
 101         memset(cli->outbuf,'\0',smb_size);
 102         set_message(NULL,cli->outbuf,10, 0, True);
 103         SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
 104         cli_setup_packet(cli);
 105
 106         SCVAL(cli->outbuf,smb_vwv0,0xFF);
 107         SSVAL(cli->outbuf,smb_vwv2,cli->max_xmit);
 108         SSVAL(cli->outbuf,smb_vwv3,2);
 109         SSVAL(cli->outbuf,smb_vwv4,1);
 110         SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
 111         SSVAL(cli->outbuf,smb_vwv7,lm_response.length);
 112
 113         p = smb_buf(cli->outbuf);
 114         memcpy(p,lm_response.data,lm_response.length);
 115         p += lm_response.length;
 116         p += clistr_push(cli, p, user, -1, STR_TERMINATE|STR_UPPER);
 117         p += clistr_push(cli, p, workgroup, -1, STR_TERMINATE|STR_UPPER);
 118         p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
 119         p += clistr_push(cli, p, "Samba", -1, STR_TERMINATE);
 120         cli_setup_bcc(cli, p);
 121
 122         if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
 123                 return cli_nt_error(cli);
 124         }
 125
 126         show_msg(cli->inbuf);
 127
 128         if (cli_is_error(cli)) {
 129                 return cli_nt_error(cli);
 130         }
 131
 132         /* use the returned vuid from now on */
 133         cli->vuid = SVAL(cli->inbuf,smb_uid);
 134         fstrcpy(cli->user_name, user);
 135
 136         if (session_key.data) {
 137                 /* Have plaintext orginal */
 138                 cli_set_session_key(cli, session_key);
 139         }
 140
 141         return NT_STATUS_OK;
 142 }
 143
 144 /****************************************************************************
 145  Work out suitable capabilities to offer the server.
 146 ****************************************************************************/
 147
 148 static uint32 cli_session_setup_capabilities(struct cli_state *cli)
 149 {
 150         uint32 capabilities = CAP_NT_SMBS;
 151
 152         if (!cli->force_dos_errors)
 153                 capabilities |= CAP_STATUS32;
 154
 155         if (cli->use_level_II_oplocks)
 156                 capabilities |= CAP_LEVEL_II_OPLOCKS;
 157
 158         capabilities |= (cli->capabilities & (CAP_UNICODE|CAP_LARGE_FILES|CAP_LARGE_READX|CAP_LARGE_WRITEX|CAP_DFS));
 159         return capabilities;
 160 }
 161
 162 /****************************************************************************
 163  Do a NT1 guest session setup.
 164 ****************************************************************************/
 165
 166 static NTSTATUS cli_session_setup_guest(struct cli_state *cli)
 167 {
 168         char *p;
 169         uint32 capabilities = cli_session_setup_capabilities(cli);
 170
 171         memset(cli->outbuf, '\0', smb_size);
 172         set_message(NULL,cli->outbuf,13,0,True);
 173         SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
 174         cli_setup_packet(cli);
 175
 176         SCVAL(cli->outbuf,smb_vwv0,0xFF);
 177         SSVAL(cli->outbuf,smb_vwv2,CLI_BUFFER_SIZE);
 178         SSVAL(cli->outbuf,smb_vwv3,2);
 179         SSVAL(cli->outbuf,smb_vwv4,cli->pid);
 180         SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
 181         SSVAL(cli->outbuf,smb_vwv7,0);
 182         SSVAL(cli->outbuf,smb_vwv8,0);
 183         SIVAL(cli->outbuf,smb_vwv11,capabilities);
 184         p = smb_buf(cli->outbuf);
 185         p += clistr_push(cli, p, "", -1, STR_TERMINATE); /* username */
 186         p += clistr_push(cli, p, "", -1, STR_TERMINATE); /* workgroup */
 187         p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
 188         p += clistr_push(cli, p, "Samba", -1, STR_TERMINATE);
 189         cli_setup_bcc(cli, p);
 190
 191         if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
 192                 return cli_nt_error(cli);
 193         }
 194
 195         show_msg(cli->inbuf);
 196
 197         if (cli_is_error(cli)) {
 198                 return cli_nt_error(cli);
 199         }
 200
 201         cli->vuid = SVAL(cli->inbuf,smb_uid);
 202
 203         p = smb_buf(cli->inbuf);
 204         p += clistr_pull(cli, cli->server_os, p, sizeof(fstring), -1, STR_TERMINATE);
 205         p += clistr_pull(cli, cli->server_type, p, sizeof(fstring), -1, STR_TERMINATE);
 206         p += clistr_pull(cli, cli->server_domain, p, sizeof(fstring), -1, STR_TERMINATE);
 207
 208         if (strstr(cli->server_type, "Samba")) {
 209                 cli->is_samba = True;
 210         }
 211
 212         fstrcpy(cli->user_name, "");
 213
 214         return NT_STATUS_OK;
 215 }
 216
 217 /****************************************************************************
 218  Do a NT1 plaintext session setup.
 219 ****************************************************************************/
 220
 221 static NTSTATUS cli_session_setup_plaintext(struct cli_state *cli,
 222                                             const char *user, const char *pass,
 223                                             const char *workgroup)
 224 {
 225         uint32 capabilities = cli_session_setup_capabilities(cli);
 226         char *p;
 227         fstring lanman;
 228
 229         fstr_sprintf( lanman, "Samba %s", SAMBA_VERSION_STRING);
 230
 231         memset(cli->outbuf, '\0', smb_size);
 232         set_message(NULL,cli->outbuf,13,0,True);
 233         SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
 234         cli_setup_packet(cli);
 235
 236         SCVAL(cli->outbuf,smb_vwv0,0xFF);
 237         SSVAL(cli->outbuf,smb_vwv2,CLI_BUFFER_SIZE);
 238         SSVAL(cli->outbuf,smb_vwv3,2);
 239         SSVAL(cli->outbuf,smb_vwv4,cli->pid);
 240         SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
 241         SSVAL(cli->outbuf,smb_vwv8,0);
 242         SIVAL(cli->outbuf,smb_vwv11,capabilities);
 243         p = smb_buf(cli->outbuf);
 244
 245         /* check wether to send the ASCII or UNICODE version of the password */
 246
 247         if ( (capabilities & CAP_UNICODE) == 0 ) {
 248                 p += clistr_push(cli, p, pass, -1, STR_TERMINATE); /* password */
 249                 SSVAL(cli->outbuf,smb_vwv7,PTR_DIFF(p, smb_buf(cli->outbuf)));
 250         }
 251         else {
 252                 p += clistr_push(cli, p, pass, -1, STR_UNICODE|STR_TERMINATE); /* unicode password */
 253                 SSVAL(cli->outbuf,smb_vwv8,PTR_DIFF(p, smb_buf(cli->outbuf)));
 254         }
 255
 256         p += clistr_push(cli, p, user, -1, STR_TERMINATE); /* username */
 257         p += clistr_push(cli, p, workgroup, -1, STR_TERMINATE); /* workgroup */
 258         p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
 259         p += clistr_push(cli, p, lanman, -1, STR_TERMINATE);
 260         cli_setup_bcc(cli, p);
 261
 262         if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
 263                 return cli_nt_error(cli);
 264         }
 265
 266         show_msg(cli->inbuf);
 267
 268         if (cli_is_error(cli)) {
 269                 return cli_nt_error(cli);
 270         }
 271
 272         cli->vuid = SVAL(cli->inbuf,smb_uid);
 273         p = smb_buf(cli->inbuf);
 274         p += clistr_pull(cli, cli->server_os, p, sizeof(fstring), -1, STR_TERMINATE);
 275         p += clistr_pull(cli, cli->server_type, p, sizeof(fstring), -1, STR_TERMINATE);
 276         p += clistr_pull(cli, cli->server_domain, p, sizeof(fstring), -1, STR_TERMINATE);
 277         fstrcpy(cli->user_name, user);
 278
 279         if (strstr(cli->server_type, "Samba")) {
 280                 cli->is_samba = True;
 281         }
 282
 283         return NT_STATUS_OK;
 284 }
 285
 286 /****************************************************************************
 287    do a NT1 NTLM/LM encrypted session setup - for when extended security
 288    is not negotiated.
 289    @param cli client state to create do session setup on
 290    @param user username
 291    @param pass *either* cleartext password (passlen !=24) or LM response.
 292    @param ntpass NT response, implies ntpasslen >=24, implies pass is not clear
 293    @param workgroup The user's domain.
 294 ****************************************************************************/
 295
 296 static NTSTATUS cli_session_setup_nt1(struct cli_state *cli, const char *user,
 297                                       const char *pass, size_t passlen,
 298                                       const char *ntpass, size_t ntpasslen,
 299                                       const char *workgroup)
 300 {
 301         uint32 capabilities = cli_session_setup_capabilities(cli);
 302         DATA_BLOB lm_response = data_blob_null;
 303         DATA_BLOB nt_response = data_blob_null;
 304         DATA_BLOB session_key = data_blob_null;
 305         NTSTATUS result;
 306         char *p;
 307
 308         if (passlen == 0) {
 309                 /* do nothing - guest login */
 310         } else if (passlen != 24) {
 311                 if (lp_client_ntlmv2_auth()) {
 312                         DATA_BLOB server_chal;
 313                         DATA_BLOB names_blob;
 314                         server_chal = data_blob(cli->secblob.data, MIN(cli->secblob.length, 8));
 315
 316                         /* note that the 'workgroup' here is a best guess - we don't know
 317                            the server's domain at this point.  The 'server name' is also
 318                            dodgy...
 319                         */
 320                         names_blob = NTLMv2_generate_names_blob(cli->called.name, workgroup);
 321
 322                         if (!SMBNTLMv2encrypt(user, workgroup, pass, &server_chal,
 323                                               &names_blob,
 324                                               &lm_response, &nt_response, &session_key)) {
 325                                 data_blob_free(&names_blob);
 326                                 data_blob_free(&server_chal);
 327                                 return NT_STATUS_ACCESS_DENIED;
 328                         }
 329                         data_blob_free(&names_blob);
 330                         data_blob_free(&server_chal);
 331
 332                 } else {
 333                         uchar nt_hash[16];
 334                         E_md4hash(pass, nt_hash);
 335
 336 #ifdef LANMAN_ONLY
 337                         nt_response = data_blob_null;
 338 #else
 339                         nt_response = data_blob(NULL, 24);
 340                         SMBNTencrypt(pass,cli->secblob.data,nt_response.data);
 341 #endif
 342                         /* non encrypted password supplied. Ignore ntpass. */
 343                         if (lp_client_lanman_auth()) {
 344                                 lm_response = data_blob(NULL, 24);
 345                                 if (!SMBencrypt(pass,cli->secblob.data, lm_response.data)) {
 346                                         /* Oops, the LM response is invalid, just put
 347                                            the NT response there instead */
 348                                         data_blob_free(&lm_response);
 349                                         lm_response = data_blob(nt_response.data, nt_response.length);
 350                                 }
 351                         } else {
 352                                 /* LM disabled, place NT# in LM field instead */
 353                                 lm_response = data_blob(nt_response.data, nt_response.length);
 354                         }
 355
 356                         session_key = data_blob(NULL, 16);
 357 #ifdef LANMAN_ONLY
 358                         E_deshash(pass, session_key.data);
 359                         memset(&session_key.data[8], '\0', 8);
 360 #else
 361                         SMBsesskeygen_ntv1(nt_hash, NULL, session_key.data);
 362 #endif
 363                 }
 364 #ifdef LANMAN_ONLY
 365                 cli_simple_set_signing(cli, session_key, lm_response);
 366 #else
 367                 cli_simple_set_signing(cli, session_key, nt_response);
 368 #endif
 369         } else {
 370                 /* pre-encrypted password supplied.  Only used for
 371                    security=server, can't do
 372                    signing because we don't have original key */
 373
 374                 lm_response = data_blob(pass, passlen);
 375                 nt_response = data_blob(ntpass, ntpasslen);
 376         }
 377
 378         /* send a session setup command */
 379         memset(cli->outbuf,'\0',smb_size);
 380
 381         set_message(NULL,cli->outbuf,13,0,True);
 382         SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
 383         cli_setup_packet(cli);
 384
 385         SCVAL(cli->outbuf,smb_vwv0,0xFF);
 386         SSVAL(cli->outbuf,smb_vwv2,CLI_BUFFER_SIZE);
 387         SSVAL(cli->outbuf,smb_vwv3,2);
 388         SSVAL(cli->outbuf,smb_vwv4,cli->pid);
 389         SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
 390         SSVAL(cli->outbuf,smb_vwv7,lm_response.length);
 391         SSVAL(cli->outbuf,smb_vwv8,nt_response.length);
 392         SIVAL(cli->outbuf,smb_vwv11,capabilities);
 393         p = smb_buf(cli->outbuf);
 394         if (lm_response.length) {
 395                 memcpy(p,lm_response.data, lm_response.length); p += lm_response.length;
 396         }
 397         if (nt_response.length) {
 398                 memcpy(p,nt_response.data, nt_response.length); p += nt_response.length;
 399         }
 400         p += clistr_push(cli, p, user, -1, STR_TERMINATE);
 401
 402         /* Upper case here might help some NTLMv2 implementations */
 403         p += clistr_push(cli, p, workgroup, -1, STR_TERMINATE|STR_UPPER);
 404         p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
 405         p += clistr_push(cli, p, "Samba", -1, STR_TERMINATE);
 406         cli_setup_bcc(cli, p);
 407
 408         if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
 409                 result = cli_nt_error(cli);
 410                 goto end;
 411         }
 412
 413         /* show_msg(cli->inbuf); */
 414
 415         if (cli_is_error(cli)) {
 416                 result = cli_nt_error(cli);
 417                 goto end;
 418         }
 419
 420         /* use the returned vuid from now on */
 421         cli->vuid = SVAL(cli->inbuf,smb_uid);
 422
 423         p = smb_buf(cli->inbuf);
 424         p += clistr_pull(cli, cli->server_os, p, sizeof(fstring), -1, STR_TERMINATE);
 425         p += clistr_pull(cli, cli->server_type, p, sizeof(fstring), -1, STR_TERMINATE);
 426         p += clistr_pull(cli, cli->server_domain, p, sizeof(fstring), -1, STR_TERMINATE);
 427
 428         if (strstr(cli->server_type, "Samba")) {
 429                 cli->is_samba = True;
 430         }
 431
 432         fstrcpy(cli->user_name, user);
 433
 434         if (session_key.data) {
 435                 /* Have plaintext orginal */
 436                 cli_set_session_key(cli, session_key);
 437         }
 438
 439         result = NT_STATUS_OK;
 440 end:
 441         data_blob_free(&lm_response);
 442         data_blob_free(&nt_response);
 443         data_blob_free(&session_key);
 444         return result;
 445 }
 446
 447 /****************************************************************************
 448  Send a extended security session setup blob
 449 ****************************************************************************/
 450
 451 static BOOL cli_session_setup_blob_send(struct cli_state *cli, DATA_BLOB blob)
 452 {
 453         uint32 capabilities = cli_session_setup_capabilities(cli);
 454         char *p;
 455
 456         capabilities |= CAP_EXTENDED_SECURITY;
 457
 458         /* send a session setup command */
 459         memset(cli->outbuf,'\0',smb_size);
 460
 461         set_message(NULL,cli->outbuf,12,0,True);
 462         SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
 463
 464         cli_setup_packet(cli);
 465
 466         SCVAL(cli->outbuf,smb_vwv0,0xFF);
 467         SSVAL(cli->outbuf,smb_vwv2,CLI_BUFFER_SIZE);
 468         SSVAL(cli->outbuf,smb_vwv3,2);
 469         SSVAL(cli->outbuf,smb_vwv4,1);
 470         SIVAL(cli->outbuf,smb_vwv5,0);
 471         SSVAL(cli->outbuf,smb_vwv7,blob.length);
 472         SIVAL(cli->outbuf,smb_vwv10,capabilities);
 473         p = smb_buf(cli->outbuf);
 474         memcpy(p, blob.data, blob.length);
 475         p += blob.length;
 476         p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
 477         p += clistr_push(cli, p, "Samba", -1, STR_TERMINATE);
 478         cli_setup_bcc(cli, p);
 479         return cli_send_smb(cli);
 480 }
 481
 482 /****************************************************************************
 483  Send a extended security session setup blob, returning a reply blob.
 484 ****************************************************************************/
 485
 486 static DATA_BLOB cli_session_setup_blob_receive(struct cli_state *cli)
 487 {
 488         DATA_BLOB blob2 = data_blob_null;
 489         char *p;
 490         size_t len;
 491
 492         if (!cli_receive_smb(cli))
 493                 return blob2;
 494
 495         show_msg(cli->inbuf);
 496
 497         if (cli_is_error(cli) && !NT_STATUS_EQUAL(cli_nt_error(cli),
 498                                                   NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 499                 return blob2;
 500         }
 501
 502         /* use the returned vuid from now on */
 503         cli->vuid = SVAL(cli->inbuf,smb_uid);
 504
 505         p = smb_buf(cli->inbuf);
 506
 507         blob2 = data_blob(p, SVAL(cli->inbuf, smb_vwv3));
 508
 509         p += blob2.length;
 510         p += clistr_pull(cli, cli->server_os, p, sizeof(fstring), -1, STR_TERMINATE);
 511
 512         /* w2k with kerberos doesn't properly null terminate this field */
 513         len = smb_buflen(cli->inbuf) - PTR_DIFF(p, smb_buf(cli->inbuf));
 514         p += clistr_pull(cli, cli->server_type, p, sizeof(fstring), len, 0);
 515
 516         return blob2;
 517 }
 518
 519 #ifdef HAVE_KRB5
 520 /****************************************************************************
 521  Send a extended security session setup blob, returning a reply blob.
 522 ****************************************************************************/
 523
 524 /* The following is calculated from :
 525  * (smb_size-4) = 35
 526  * (smb_wcnt * 2) = 24 (smb_wcnt == 12 in cli_session_setup_blob_send() )
 527  * (strlen("Unix") + 1 + strlen("Samba") + 1) * 2 = 22 (unicode strings at
 528  * end of packet.
 529  */
 530
 531 #define BASE_SESSSETUP_BLOB_PACKET_SIZE (35 + 24 + 22)
 532
 533 static BOOL cli_session_setup_blob(struct cli_state *cli, DATA_BLOB blob, DATA_BLOB session_key_krb5)
 534 {
 535         int32 remaining = blob.length;
 536         int32 cur = 0;
 537         DATA_BLOB send_blob = data_blob_null;
 538         int32 max_blob_size = 0;
 539         DATA_BLOB receive_blob = data_blob_null;
 540
 541         if (cli->max_xmit < BASE_SESSSETUP_BLOB_PACKET_SIZE + 1) {
 542                 DEBUG(0,("cli_session_setup_blob: cli->max_xmit too small "
 543                         "(was %u, need minimum %u)\n",
 544                         (unsigned int)cli->max_xmit,
 545                         BASE_SESSSETUP_BLOB_PACKET_SIZE));
 546                 cli_set_nt_error(cli, NT_STATUS_INVALID_PARAMETER);
 547                 return False;
 548         }
 549
 550         max_blob_size = cli->max_xmit - BASE_SESSSETUP_BLOB_PACKET_SIZE;
 551
 552         while ( remaining > 0) {
 553                 if (remaining >= max_blob_size) {
 554                         send_blob.length = max_blob_size;
 555                         remaining -= max_blob_size;
 556                 } else {
 557                         DATA_BLOB null_blob = data_blob_null;
 558
 559                         send_blob.length = remaining;
 560                         remaining = 0;
 561
 562                         /* This is the last packet in the sequence - turn signing on. */
 563                         cli_simple_set_signing(cli, session_key_krb5, null_blob);
 564                 }
 565
 566                 send_blob.data =  &blob.data[cur];
 567                 cur += send_blob.length;
 568
 569                 DEBUG(10, ("cli_session_setup_blob: Remaining (%u) sending (%u) current (%u)\n",
 570                         (unsigned int)remaining,
 571                         (unsigned int)send_blob.length,
 572                         (unsigned int)cur ));
 573
 574                 if (!cli_session_setup_blob_send(cli, send_blob)) {
 575                         DEBUG(0, ("cli_session_setup_blob: send failed\n"));
 576                         return False;
 577                 }
 578
 579                 receive_blob = cli_session_setup_blob_receive(cli);
 580                 data_blob_free(&receive_blob);
 581
 582                 if (cli_is_error(cli) &&
 583                                 !NT_STATUS_EQUAL( cli_get_nt_error(cli),
 584                                         NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 585                         DEBUG(0, ("cli_session_setup_blob: recieve failed (%s)\n",
 586                                 nt_errstr(cli_get_nt_error(cli)) ));
 587                         return False;
 588                 }
 589         }
 590
 591         return True;
 592 }
 593
 594 /****************************************************************************
 595  Use in-memory credentials cache
 596 ****************************************************************************/
 597
 598 static void use_in_memory_ccache(void) {
 599         setenv(KRB5_ENV_CCNAME, "MEMORY:cliconnect", 1);
 600 }
 601
 602 /****************************************************************************
 603  Do a spnego/kerberos encrypted session setup.
 604 ****************************************************************************/
 605
 606 static ADS_STATUS cli_session_setup_kerberos(struct cli_state *cli, const char *principal, const char *workgroup)
 607 {
 608         DATA_BLOB negTokenTarg;
 609         DATA_BLOB session_key_krb5;
 610         int rc;
 611
 612         DEBUG(2,("Doing kerberos session setup\n"));
 613
 614         /* generate the encapsulated kerberos5 ticket */
 615         rc = spnego_gen_negTokenTarg(principal, 0, &negTokenTarg, &session_key_krb5, 0, NULL);
 616
 617         if (rc) {
 618                 DEBUG(1, ("cli_session_setup_kerberos: spnego_gen_negTokenTarg failed: %s\n",
 619                         error_message(rc)));
 620                 return ADS_ERROR_KRB5(rc);
 621         }
 622
 623 #if 0
 624         file_save("negTokenTarg.dat", negTokenTarg.data, negTokenTarg.length);
 625 #endif
 626
 627         if (!cli_session_setup_blob(cli, negTokenTarg, session_key_krb5)) {
 628                 data_blob_free(&negTokenTarg);
 629                 data_blob_free(&session_key_krb5);
 630                 ADS_ERROR_NT(cli_nt_error(cli));
 631         }
 632
 633         cli_set_session_key(cli, session_key_krb5);
 634
 635         data_blob_free(&negTokenTarg);
 636         data_blob_free(&session_key_krb5);
 637
 638         if (cli_is_error(cli)) {
 639                 if (NT_STATUS_IS_OK(cli_nt_error(cli))) {
 640                         return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
 641                 }
 642         }
 643         return ADS_ERROR_NT(cli_nt_error(cli));
 644 }
 645 #endif  /* HAVE_KRB5 */
 646
 647
 648 /****************************************************************************
 649  Do a spnego/NTLMSSP encrypted session setup.
 650 ****************************************************************************/
 651
 652 static NTSTATUS cli_session_setup_ntlmssp(struct cli_state *cli, const char *user,
 653                                           const char *pass, const char *domain)
 654 {
 655         struct ntlmssp_state *ntlmssp_state;
 656         NTSTATUS nt_status;
 657         int turn = 1;
 658         DATA_BLOB msg1;
 659         DATA_BLOB blob = data_blob_null;
 660         DATA_BLOB blob_in = data_blob_null;
 661         DATA_BLOB blob_out = data_blob_null;
 662
 663         cli_temp_set_signing(cli);
 664
 665         if (!NT_STATUS_IS_OK(nt_status = ntlmssp_client_start(&ntlmssp_state))) {
 666                 return nt_status;
 667         }
 668         ntlmssp_want_feature(ntlmssp_state, NTLMSSP_FEATURE_SESSION_KEY);
 669
 670         if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_username(ntlmssp_state, user))) {
 671                 return nt_status;
 672         }
 673         if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_domain(ntlmssp_state, domain))) {
 674                 return nt_status;
 675         }
 676         if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_password(ntlmssp_state, pass))) {
 677                 return nt_status;
 678         }
 679
 680         do {
 681                 nt_status = ntlmssp_update(ntlmssp_state,
 682                                                   blob_in, &blob_out);
 683                 data_blob_free(&blob_in);
 684                 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED) || NT_STATUS_IS_OK(nt_status)) {
 685                         if (turn == 1) {
 686                                 /* and wrap it in a SPNEGO wrapper */
 687                                 msg1 = gen_negTokenInit(OID_NTLMSSP, blob_out);
 688                         } else {
 689                                 /* wrap it in SPNEGO */
 690                                 msg1 = spnego_gen_auth(blob_out);
 691                         }
 692
 693                         /* now send that blob on its way */
 694                         if (!cli_session_setup_blob_send(cli, msg1)) {
 695                                 DEBUG(3, ("Failed to send NTLMSSP/SPNEGO blob to server!\n"));
 696                                 nt_status = NT_STATUS_UNSUCCESSFUL;
 697                         } else {
 698                                 blob = cli_session_setup_blob_receive(cli);
 699
 700                                 nt_status = cli_nt_error(cli);
 701                                 if (cli_is_error(cli) && NT_STATUS_IS_OK(nt_status)) {
 702                                         if (cli->smb_rw_error == READ_BAD_SIG) {
 703                                                 nt_status = NT_STATUS_ACCESS_DENIED;
 704                                         } else {
 705                                                 nt_status = NT_STATUS_UNSUCCESSFUL;
 706                                         }
 707                                 }
 708                         }
 709                         data_blob_free(&msg1);
 710                 }
 711
 712                 if (!blob.length) {
 713                         if (NT_STATUS_IS_OK(nt_status)) {
 714                                 nt_status = NT_STATUS_UNSUCCESSFUL;
 715                         }
 716                 } else if ((turn == 1) &&
 717                            NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 718                         DATA_BLOB tmp_blob = data_blob_null;
 719                         /* the server might give us back two challenges */
 720                         if (!spnego_parse_challenge(blob, &blob_in,
 721                                                     &tmp_blob)) {
 722                                 DEBUG(3,("Failed to parse challenges\n"));
 723                                 nt_status = NT_STATUS_INVALID_PARAMETER;
 724                         }
 725                         data_blob_free(&tmp_blob);
 726                 } else {
 727                         if (!spnego_parse_auth_response(blob, nt_status, OID_NTLMSSP,
 728                                                         &blob_in)) {
 729                                 DEBUG(3,("Failed to parse auth response\n"));
 730                                 if (NT_STATUS_IS_OK(nt_status)
 731                                     || NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED))
 732                                         nt_status = NT_STATUS_INVALID_PARAMETER;
 733                         }
 734                 }
 735                 data_blob_free(&blob);
 736                 data_blob_free(&blob_out);
 737                 turn++;
 738         } while (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED));
 739
 740         data_blob_free(&blob_in);
 741
 742         if (NT_STATUS_IS_OK(nt_status)) {
 743
 744                 DATA_BLOB key = data_blob(ntlmssp_state->session_key.data,
 745                                           ntlmssp_state->session_key.length);
 746                 DATA_BLOB null_blob = data_blob_null;
 747                 BOOL res;
 748
 749                 fstrcpy(cli->server_domain, ntlmssp_state->server_domain);
 750                 cli_set_session_key(cli, ntlmssp_state->session_key);
 751
 752                 res = cli_simple_set_signing(cli, key, null_blob);
 753
 754                 data_blob_free(&key);
 755
 756                 if (res) {
 757
 758                         /* 'resign' the last message, so we get the right sequence numbers
 759                            for checking the first reply from the server */
 760                         cli_calculate_sign_mac(cli);
 761
 762                         if (!cli_check_sign_mac(cli)) {
 763                                 nt_status = NT_STATUS_ACCESS_DENIED;
 764                         }
 765                 }
 766         }
 767
 768         /* we have a reference counter on ntlmssp_state, if we are signing
 769            then the state will be kept by the signing engine */
 770
 771         ntlmssp_end(&ntlmssp_state);
 772
 773         return nt_status;
 774 }
 775
 776 /****************************************************************************
 777  Do a spnego encrypted session setup.
 778 ****************************************************************************/
 779
 780 ADS_STATUS cli_session_setup_spnego(struct cli_state *cli, const char *user,
 781                               const char *pass, const char *domain)
 782 {
 783         char *principal;
 784         char *OIDs[ASN1_MAX_OIDS];
 785         int i;
 786         BOOL got_kerberos_mechanism = False;
 787         DATA_BLOB blob;
 788
 789         DEBUG(3,("Doing spnego session setup (blob length=%lu)\n", (unsigned long)cli->secblob.length));
 790
 791         /* the server might not even do spnego */
 792         if (cli->secblob.length <= 16) {
 793                 DEBUG(3,("server didn't supply a full spnego negprot\n"));
 794                 goto ntlmssp;
 795         }
 796
 797 #if 0
 798         file_save("negprot.dat", cli->secblob.data, cli->secblob.length);
 799 #endif
 800
 801         /* there is 16 bytes of GUID before the real spnego packet starts */
 802         blob = data_blob(cli->secblob.data+16, cli->secblob.length-16);
 803
 804         /* the server sent us the first part of the SPNEGO exchange in the negprot
 805            reply */
 806         if (!spnego_parse_negTokenInit(blob, OIDs, &principal)) {
 807                 data_blob_free(&blob);
 808                 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
 809         }
 810         data_blob_free(&blob);
 811
 812         /* make sure the server understands kerberos */
 813         for (i=0;OIDs[i];i++) {
 814                 DEBUG(3,("got OID=%s\n", OIDs[i]));
 815                 if (strcmp(OIDs[i], OID_KERBEROS5_OLD) == 0 ||
 816                     strcmp(OIDs[i], OID_KERBEROS5) == 0) {
 817                         got_kerberos_mechanism = True;
 818                 }
 819                 free(OIDs[i]);
 820         }
 821
 822         DEBUG(3,("got principal=%s\n", principal ? principal : "<null>"));
 823
 824         if (got_kerberos_mechanism && (principal == NULL)) {
 825                 /*
 826                  * It is WRONG to depend on the principal sent in the negprot
 827                  * reply, but right now we do it. So for safety (don't
 828                  * segfault later) disable Kerberos when no principal was
 829                  * sent. -- VL
 830                  */
 831                 DEBUG(1, ("Kerberos mech was offered, but no principal was "
 832                           "sent, disabling Kerberos\n"));
 833                 cli->use_kerberos = False;
 834         }
 835
 836         fstrcpy(cli->user_name, user);
 837
 838 #ifdef HAVE_KRB5
 839         /* If password is set we reauthenticate to kerberos server
 840          * and do not store results */
 841
 842         if (got_kerberos_mechanism && cli->use_kerberos) {
 843                 ADS_STATUS rc;
 844
 845                 if (pass && *pass) {
 846                         int ret;
 847
 848                         use_in_memory_ccache();
 849                         ret = kerberos_kinit_password(user, pass, 0 /* no time correction for now */, NULL);
 850
 851                         if (ret){
 852                                 SAFE_FREE(principal);
 853                                 DEBUG(0, ("Kinit failed: %s\n", error_message(ret)));
 854                                 if (cli->fallback_after_kerberos)
 855                                         goto ntlmssp;
 856                                 return ADS_ERROR_KRB5(ret);
 857                         }
 858                 }
 859
 860                 rc = cli_session_setup_kerberos(cli, principal, domain);
 861                 if (ADS_ERR_OK(rc) || !cli->fallback_after_kerberos) {
 862                         SAFE_FREE(principal);
 863                         return rc;
 864                 }
 865         }
 866 #endif
 867
 868         SAFE_FREE(principal);
 869
 870 ntlmssp:
 871
 872         return ADS_ERROR_NT(cli_session_setup_ntlmssp(cli, user, pass, domain));
 873 }
 874
 875 /****************************************************************************
 876  Send a session setup. The username and workgroup is in UNIX character
 877  format and must be converted to DOS codepage format before sending. If the
 878  password is in plaintext, the same should be done.
 879 ****************************************************************************/
 880
 881 NTSTATUS cli_session_setup(struct cli_state *cli,
 882                            const char *user,
 883                            const char *pass, int passlen,
 884                            const char *ntpass, int ntpasslen,
 885                            const char *workgroup)
 886 {
 887         char *p;
 888         fstring user2;
 889
 890         /* allow for workgroups as part of the username */
 891         fstrcpy(user2, user);
 892         if ((p=strchr_m(user2,'\\')) || (p=strchr_m(user2,'/')) ||
 893             (p=strchr_m(user2,*lp_winbind_separator()))) {
 894                 *p = 0;
 895                 user = p+1;
 896                 workgroup = user2;
 897         }
 898
 899         if (cli->protocol < PROTOCOL_LANMAN1) {
 900                 return NT_STATUS_OK;
 901         }
 902
 903         /* now work out what sort of session setup we are going to
 904            do. I have split this into separate functions to make the
 905            flow a bit easier to understand (tridge) */
 906
 907         /* if its an older server then we have to use the older request format */
 908
 909         if (cli->protocol < PROTOCOL_NT1) {
 910                 if (!lp_client_lanman_auth() && passlen != 24 && (*pass)) {
 911                         DEBUG(1, ("Server requested LM password but 'client lanman auth'"
 912                                   " is disabled\n"));
 913                         return NT_STATUS_ACCESS_DENIED;
 914                 }
 915
 916                 if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0 &&
 917                     !lp_client_plaintext_auth() && (*pass)) {
 918                         DEBUG(1, ("Server requested plaintext password but 'client use plaintext auth'"
 919                                   " is disabled\n"));
 920                         return NT_STATUS_ACCESS_DENIED;
 921                 }
 922
 923                 return cli_session_setup_lanman2(cli, user, pass, passlen,
 924                                                  workgroup);
 925         }
 926
 927         /* if no user is supplied then we have to do an anonymous connection.
 928            passwords are ignored */
 929
 930         if (!user || !*user)
 931                 return cli_session_setup_guest(cli);
 932
 933         /* if the server is share level then send a plaintext null
 934            password at this point. The password is sent in the tree
 935            connect */
 936
 937         if ((cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) == 0)
 938                 return cli_session_setup_plaintext(cli, user, "", workgroup);
 939
 940         /* if the server doesn't support encryption then we have to use
 941            plaintext. The second password is ignored */
 942
 943         if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0) {
 944                 if (!lp_client_plaintext_auth() && (*pass)) {
 945                         DEBUG(1, ("Server requested plaintext password but 'client use plaintext auth'"
 946                                   " is disabled\n"));
 947                         return NT_STATUS_ACCESS_DENIED;
 948                 }
 949                 return cli_session_setup_plaintext(cli, user, pass, workgroup);
 950         }
 951
 952         /* if the server supports extended security then use SPNEGO */
 953
 954         if (cli->capabilities & CAP_EXTENDED_SECURITY) {
 955                 ADS_STATUS status = cli_session_setup_spnego(cli, user, pass, workgroup);
 956                 if (!ADS_ERR_OK(status)) {
 957                         DEBUG(3, ("SPNEGO login failed: %s\n", ads_errstr(status)));
 958                         return ads_ntstatus(status);
 959                 }
 960         } else {
 961                 NTSTATUS status;
 962
 963                 /* otherwise do a NT1 style session setup */
 964                 status = cli_session_setup_nt1(cli, user, pass, passlen,
 965                                                ntpass, ntpasslen, workgroup);
 966                 if (!NT_STATUS_IS_OK(status)) {
 967                         DEBUG(3,("cli_session_setup: NT1 session setup "
 968                                  "failed: %s\n", nt_errstr(status)));
 969                         return status;
 970                 }
 971         }
 972
 973         if (strstr(cli->server_type, "Samba")) {
 974                 cli->is_samba = True;
 975         }
 976
 977         return NT_STATUS_OK;
 978 }
 979
 980 /****************************************************************************
 981  Send a uloggoff.
 982 *****************************************************************************/
 983
 984 BOOL cli_ulogoff(struct cli_state *cli)
 985 {
 986         memset(cli->outbuf,'\0',smb_size);
 987         set_message(NULL,cli->outbuf,2,0,True);
 988         SCVAL(cli->outbuf,smb_com,SMBulogoffX);
 989         cli_setup_packet(cli);
 990         SSVAL(cli->outbuf,smb_vwv0,0xFF);
 991         SSVAL(cli->outbuf,smb_vwv2,0);  /* no additional info */
 992
 993         cli_send_smb(cli);
 994         if (!cli_receive_smb(cli))
 995                 return False;
 996
 997         if (cli_is_error(cli)) {
 998                 return False;
 999         }
1000
1001         cli->cnum = -1;
1002         return True;
1003 }
1004
1005 /****************************************************************************
1006  Send a tconX.
1007 ****************************************************************************/
1008
1009 BOOL cli_send_tconX(struct cli_state *cli,
1010                     const char *share, const char *dev, const char *pass, int passlen)
1011 {
1012         fstring fullshare, pword;
1013         char *p;
1014         memset(cli->outbuf,'\0',smb_size);
1015         memset(cli->inbuf,'\0',smb_size);
1016
1017         fstrcpy(cli->share, share);
1018
1019         /* in user level security don't send a password now */
1020         if (cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) {
1021                 passlen = 1;
1022                 pass = "";
1023         } else if (!pass) {
1024                 DEBUG(1, ("Server not using user level security and no password supplied.\n"));
1025                 return False;
1026         }
1027
1028         if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) &&
1029             *pass && passlen != 24) {
1030                 if (!lp_client_lanman_auth()) {
1031                         DEBUG(1, ("Server requested LANMAN password (share-level security) but 'client use lanman auth'"
1032                                   " is disabled\n"));
1033                         return False;
1034                 }
1035
1036                 /*
1037                  * Non-encrypted passwords - convert to DOS codepage before encryption.
1038                  */
1039                 passlen = 24;
1040                 SMBencrypt(pass,cli->secblob.data,(uchar *)pword);
1041         } else {
1042                 if((cli->sec_mode & (NEGOTIATE_SECURITY_USER_LEVEL|NEGOTIATE_SECURITY_CHALLENGE_RESPONSE)) == 0) {
1043                         if (!lp_client_plaintext_auth() && (*pass)) {
1044                                 DEBUG(1, ("Server requested plaintext password but 'client use plaintext auth'"
1045                                           " is disabled\n"));
1046                                 return False;
1047                         }
1048
1049                         /*
1050                          * Non-encrypted passwords - convert to DOS codepage before using.
1051                          */
1052                         passlen = clistr_push(cli, pword, pass, sizeof(pword), STR_TERMINATE);
1053
1054                 } else {
1055                         if (passlen) {
1056                                 memcpy(pword, pass, passlen);
1057                         }
1058                 }
1059         }
1060
1061         slprintf(fullshare, sizeof(fullshare)-1,
1062                  "\\\\%s\\%s", cli->desthost, share);
1063
1064         set_message(NULL,cli->outbuf,4, 0, True);
1065         SCVAL(cli->outbuf,smb_com,SMBtconX);
1066         cli_setup_packet(cli);
1067
1068         SSVAL(cli->outbuf,smb_vwv0,0xFF);
1069         SSVAL(cli->outbuf,smb_vwv2,TCONX_FLAG_EXTENDED_RESPONSE);
1070         SSVAL(cli->outbuf,smb_vwv3,passlen);
1071
1072         p = smb_buf(cli->outbuf);
1073         if (passlen) {
1074                 memcpy(p,pword,passlen);
1075         }
1076         p += passlen;
1077         p += clistr_push(cli, p, fullshare, -1, STR_TERMINATE |STR_UPPER);
1078         p += clistr_push(cli, p, dev, -1, STR_TERMINATE |STR_UPPER | STR_ASCII);
1079
1080         cli_setup_bcc(cli, p);
1081
1082         cli_send_smb(cli);
1083         if (!cli_receive_smb(cli))
1084                 return False;
1085
1086         if (cli_is_error(cli))
1087                 return False;
1088
1089         clistr_pull(cli, cli->dev, smb_buf(cli->inbuf), sizeof(fstring), -1, STR_TERMINATE|STR_ASCII);
1090
1091         if (cli->protocol >= PROTOCOL_NT1 &&
1092             smb_buflen(cli->inbuf) == 3) {
1093                 /* almost certainly win95 - enable bug fixes */
1094                 cli->win95 = True;
1095         }
1096
1097         /* Make sure that we have the optional support 16-bit field.  WCT > 2 */
1098         /* Avoids issues when connecting to Win9x boxes sharing files */
1099
1100         cli->dfsroot = False;
1101         if ( (CVAL(cli->inbuf, smb_wct))>2 && cli->protocol >= PROTOCOL_LANMAN2 )
1102                 cli->dfsroot = (SVAL( cli->inbuf, smb_vwv2 ) & SMB_SHARE_IN_DFS) ? True : False;
1103
1104         cli->cnum = SVAL(cli->inbuf,smb_tid);
1105         return True;
1106 }
1107
1108 /****************************************************************************
1109  Send a tree disconnect.
1110 ****************************************************************************/
1111
1112 BOOL cli_tdis(struct cli_state *cli)
1113 {
1114         memset(cli->outbuf,'\0',smb_size);
1115         set_message(NULL,cli->outbuf,0,0,True);
1116         SCVAL(cli->outbuf,smb_com,SMBtdis);
1117         SSVAL(cli->outbuf,smb_tid,cli->cnum);
1118         cli_setup_packet(cli);
1119
1120         cli_send_smb(cli);
1121         if (!cli_receive_smb(cli))
1122                 return False;
1123
1124         if (cli_is_error(cli)) {
1125                 return False;
1126         }
1127
1128         cli->cnum = -1;
1129         return True;
1130 }
1131
1132 /****************************************************************************
1133  Send a negprot command.
1134 ****************************************************************************/
1135
1136 void cli_negprot_send(struct cli_state *cli)
1137 {
1138         char *p;
1139         int numprots;
1140
1141         if (cli->protocol < PROTOCOL_NT1)
1142                 cli->use_spnego = False;
1143
1144         memset(cli->outbuf,'\0',smb_size);
1145
1146         /* setup the protocol strings */
1147         set_message(NULL,cli->outbuf,0,0,True);
1148
1149         p = smb_buf(cli->outbuf);
1150         for (numprots=0;
1151              prots[numprots].name && prots[numprots].prot<=cli->protocol;
1152              numprots++) {
1153                 *p++ = 2;
1154                 p += clistr_push(cli, p, prots[numprots].name, -1, STR_TERMINATE);
1155         }
1156
1157         SCVAL(cli->outbuf,smb_com,SMBnegprot);
1158         cli_setup_bcc(cli, p);
1159         cli_setup_packet(cli);
1160
1161         SCVAL(smb_buf(cli->outbuf),0,2);
1162
1163         cli_send_smb(cli);
1164 }
1165
1166 /****************************************************************************
1167  Send a negprot command.
1168 ****************************************************************************/
1169
1170 BOOL cli_negprot(struct cli_state *cli)
1171 {
1172         char *p;
1173         int numprots;
1174         int plength;
1175
1176         if (cli->protocol < PROTOCOL_NT1)
1177                 cli->use_spnego = False;
1178
1179         memset(cli->outbuf,'\0',smb_size);
1180
1181         /* setup the protocol strings */
1182         for (plength=0,numprots=0;
1183              prots[numprots].name && prots[numprots].prot<=cli->protocol;
1184              numprots++)
1185                 plength += strlen(prots[numprots].name)+2;
1186
1187         set_message(NULL,cli->outbuf,0,plength,True);
1188
1189         p = smb_buf(cli->outbuf);
1190         for (numprots=0;
1191              prots[numprots].name && prots[numprots].prot<=cli->protocol;
1192              numprots++) {
1193                 *p++ = 2;
1194                 p += clistr_push(cli, p, prots[numprots].name, -1, STR_TERMINATE);
1195         }
1196
1197         SCVAL(cli->outbuf,smb_com,SMBnegprot);
1198         cli_setup_packet(cli);
1199
1200         SCVAL(smb_buf(cli->outbuf),0,2);
1201
1202         cli_send_smb(cli);
1203         if (!cli_receive_smb(cli))
1204                 return False;
1205
1206         show_msg(cli->inbuf);
1207
1208         if (cli_is_error(cli) ||
1209             ((int)SVAL(cli->inbuf,smb_vwv0) >= numprots)) {
1210                 return(False);
1211         }
1212
1213         cli->protocol = prots[SVAL(cli->inbuf,smb_vwv0)].prot;
1214
1215         if ((cli->protocol < PROTOCOL_NT1) && cli->sign_info.mandatory_signing) {
1216                 DEBUG(0,("cli_negprot: SMB signing is mandatory and the selected protocol level doesn't support it.\n"));
1217                 return False;
1218         }
1219
1220         if (cli->protocol >= PROTOCOL_NT1) {
1221                 struct timespec ts;
1222                 /* NT protocol */
1223                 cli->sec_mode = CVAL(cli->inbuf,smb_vwv1);
1224                 cli->max_mux = SVAL(cli->inbuf, smb_vwv1+1);
1225                 cli->max_xmit = IVAL(cli->inbuf,smb_vwv3+1);
1226                 cli->sesskey = IVAL(cli->inbuf,smb_vwv7+1);
1227                 cli->serverzone = SVALS(cli->inbuf,smb_vwv15+1);
1228                 cli->serverzone *= 60;
1229                 /* this time arrives in real GMT */
1230                 ts = interpret_long_date(cli->inbuf+smb_vwv11+1);
1231                 cli->servertime = ts.tv_sec;
1232                 cli->secblob = data_blob(smb_buf(cli->inbuf),smb_buflen(cli->inbuf));
1233                 cli->capabilities = IVAL(cli->inbuf,smb_vwv9+1);
1234                 if (cli->capabilities & CAP_RAW_MODE) {
1235                         cli->readbraw_supported = True;
1236                         cli->writebraw_supported = True;
1237                 }
1238                 /* work out if they sent us a workgroup */
1239                 if (!(cli->capabilities & CAP_EXTENDED_SECURITY) &&
1240                     smb_buflen(cli->inbuf) > 8) {
1241                         clistr_pull(cli, cli->server_domain,
1242                                     smb_buf(cli->inbuf)+8, sizeof(cli->server_domain),
1243                                     smb_buflen(cli->inbuf)-8, STR_UNICODE|STR_NOALIGN);
1244                 }
1245
1246                 /*
1247                  * As signing is slow we only turn it on if either the client or
1248                  * the server require it. JRA.
1249                  */
1250
1251                 if (cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED) {
1252                         /* Fail if server says signing is mandatory and we don't want to support it. */
1253                         if (!cli->sign_info.allow_smb_signing) {
1254                                 DEBUG(0,("cli_negprot: SMB signing is mandatory and we have disabled it.\n"));
1255                                 return False;
1256                         }
1257                         cli->sign_info.negotiated_smb_signing = True;
1258                         cli->sign_info.mandatory_signing = True;
1259                 } else if (cli->sign_info.mandatory_signing && cli->sign_info.allow_smb_signing) {
1260                         /* Fail if client says signing is mandatory and the server doesn't support it. */
1261                         if (!(cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED)) {
1262                                 DEBUG(1,("cli_negprot: SMB signing is mandatory and the server doesn't support it.\n"));
1263                                 return False;
1264                         }
1265                         cli->sign_info.negotiated_smb_signing = True;
1266                         cli->sign_info.mandatory_signing = True;
1267                 } else if (cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED) {
1268                         cli->sign_info.negotiated_smb_signing = True;
1269                 }
1270
1271                 if (cli->capabilities & (CAP_LARGE_READX|CAP_LARGE_WRITEX)) {
1272                         SAFE_FREE(cli->outbuf);
1273                         SAFE_FREE(cli->inbuf);
1274                         cli->outbuf = (char *)SMB_MALLOC(CLI_SAMBA_MAX_LARGE_READX_SIZE+SAFETY_MARGIN);
1275                         cli->inbuf = (char *)SMB_MALLOC(CLI_SAMBA_MAX_LARGE_READX_SIZE+SAFETY_MARGIN);
1276                         cli->bufsize = CLI_SAMBA_MAX_LARGE_READX_SIZE;
1277                 }
1278
1279         } else if (cli->protocol >= PROTOCOL_LANMAN1) {
1280                 cli->use_spnego = False;
1281                 cli->sec_mode = SVAL(cli->inbuf,smb_vwv1);
1282                 cli->max_xmit = SVAL(cli->inbuf,smb_vwv2);
1283                 cli->max_mux = SVAL(cli->inbuf, smb_vwv3);
1284                 cli->sesskey = IVAL(cli->inbuf,smb_vwv6);
1285                 cli->serverzone = SVALS(cli->inbuf,smb_vwv10);
1286                 cli->serverzone *= 60;
1287                 /* this time is converted to GMT by make_unix_date */
1288                 cli->servertime = cli_make_unix_date(cli,cli->inbuf+smb_vwv8);
1289                 cli->readbraw_supported = ((SVAL(cli->inbuf,smb_vwv5) & 0x1) != 0);
1290                 cli->writebraw_supported = ((SVAL(cli->inbuf,smb_vwv5) & 0x2) != 0);
1291                 cli->secblob = data_blob(smb_buf(cli->inbuf),smb_buflen(cli->inbuf));
1292         } else {
1293                 /* the old core protocol */
1294                 cli->use_spnego = False;
1295                 cli->sec_mode = 0;
1296                 cli->serverzone = get_time_zone(time(NULL));
1297         }
1298
1299         cli->max_xmit = MIN(cli->max_xmit, CLI_BUFFER_SIZE);
1300
1301         /* a way to force ascii SMB */
1302         if (getenv("CLI_FORCE_ASCII"))
1303                 cli->capabilities &= ~CAP_UNICODE;
1304
1305         return True;
1306 }
1307
1308 /****************************************************************************
1309  Send a session request. See rfc1002.txt 4.3 and 4.3.2.
1310 ****************************************************************************/
1311
1312 BOOL cli_session_request(struct cli_state *cli,
1313                          struct nmb_name *calling, struct nmb_name *called)
1314 {
1315         char *p;
1316         int len = 4;
1317
1318         memcpy(&(cli->calling), calling, sizeof(*calling));
1319         memcpy(&(cli->called ), called , sizeof(*called ));
1320
1321         /* put in the destination name */
1322         p = cli->outbuf+len;
1323         name_mangle(cli->called .name, p, cli->called .name_type);
1324         len += name_len(p);
1325
1326         /* and my name */
1327         p = cli->outbuf+len;
1328         name_mangle(cli->calling.name, p, cli->calling.name_type);
1329         len += name_len(p);
1330
1331         /* 445 doesn't have session request */
1332         if (cli->port == 445)
1333                 return True;
1334
1335         /* send a session request (RFC 1002) */
1336         /* setup the packet length
1337          * Remove four bytes from the length count, since the length
1338          * field in the NBT Session Service header counts the number
1339          * of bytes which follow.  The cli_send_smb() function knows
1340          * about this and accounts for those four bytes.
1341          * CRH.
1342          */
1343         len -= 4;
1344         _smb_setlen(cli->outbuf,len);
1345         SCVAL(cli->outbuf,0,0x81);
1346
1347         cli_send_smb(cli);
1348         DEBUG(5,("Sent session request\n"));
1349
1350         if (!cli_receive_smb(cli))
1351                 return False;
1352
1353         if (CVAL(cli->inbuf,0) == 0x84) {
1354                 /* C. Hoch  9/14/95 Start */
1355                 /* For information, here is the response structure.
1356                  * We do the byte-twiddling to for portability.
1357                 struct RetargetResponse{
1358                 unsigned char type;
1359                 unsigned char flags;
1360                 int16 length;
1361                 int32 ip_addr;
1362                 int16 port;
1363                 };
1364                 */
1365                 int port = (CVAL(cli->inbuf,8)<<8)+CVAL(cli->inbuf,9);
1366                 /* SESSION RETARGET */
1367                 putip((char *)&cli->dest_ip,cli->inbuf+4);
1368
1369                 cli->fd = open_socket_out(SOCK_STREAM, &cli->dest_ip, port, LONG_CONNECT_TIMEOUT);
1370                 if (cli->fd == -1)
1371                         return False;
1372
1373                 DEBUG(3,("Retargeted\n"));
1374
1375                 set_socket_options(cli->fd,user_socket_options);
1376
1377                 /* Try again */
1378                 {
1379                         static int depth;
1380                         BOOL ret;
1381                         if (depth > 4) {
1382                                 DEBUG(0,("Retarget recursion - failing\n"));
1383                                 return False;
1384                         }
1385                         depth++;
1386                         ret = cli_session_request(cli, calling, called);
1387                         depth--;
1388                         return ret;
1389                 }
1390         } /* C. Hoch 9/14/95 End */
1391
1392         if (CVAL(cli->inbuf,0) != 0x82) {
1393                 /* This is the wrong place to put the error... JRA. */
1394                 cli->rap_error = CVAL(cli->inbuf,4);
1395                 return False;
1396         }
1397         return(True);
1398 }
1399
1400 /****************************************************************************
1401  Open the client sockets.
1402 ****************************************************************************/
1403
1404 BOOL cli_connect(struct cli_state *cli, const char *host, struct in_addr *ip)
1405 {
1406         int name_type = 0x20;
1407         char *p;
1408
1409         /* reasonable default hostname */
1410         if (!host) host = "*SMBSERVER";
1411
1412         fstrcpy(cli->desthost, host);
1413
1414         /* allow hostnames of the form NAME#xx and do a netbios lookup */
1415         if ((p = strchr(cli->desthost, '#'))) {
1416                 name_type = strtol(p+1, NULL, 16);
1417                 *p = 0;
1418         }
1419
1420         if (!ip || is_zero_ip(*ip)) {
1421                 if (!resolve_name(cli->desthost, &cli->dest_ip, name_type)) {
1422                         return False;
1423                 }
1424                 if (ip) *ip = cli->dest_ip;
1425         } else {
1426                 cli->dest_ip = *ip;
1427         }
1428
1429         if (getenv("LIBSMB_PROG")) {
1430                 cli->fd = sock_exec(getenv("LIBSMB_PROG"));
1431         } else {
1432                 /* try 445 first, then 139 */
1433                 int port = cli->port?cli->port:445;
1434                 cli->fd = open_socket_out(SOCK_STREAM, &cli->dest_ip,
1435                                           port, cli->timeout);
1436                 if (cli->fd == -1 && cli->port == 0) {
1437                         port = 139;
1438                         cli->fd = open_socket_out(SOCK_STREAM, &cli->dest_ip,
1439                                                   port, cli->timeout);
1440                 }
1441                 if (cli->fd != -1)
1442                         cli->port = port;
1443         }
1444         if (cli->fd == -1) {
1445                 DEBUG(1,("Error connecting to %s (%s)\n",
1446                          ip?inet_ntoa(*ip):host,strerror(errno)));
1447                 return False;
1448         }
1449
1450         set_socket_options(cli->fd,user_socket_options);
1451
1452         return True;
1453 }
1454
1455 /**
1456    establishes a connection to after the negprot.
1457    @param output_cli A fully initialised cli structure, non-null only on success
1458    @param dest_host The netbios name of the remote host
1459    @param dest_ip (optional) The the destination IP, NULL for name based lookup
1460    @param port (optional) The destination port (0 for default)
1461    @param retry BOOL. Did this connection fail with a retryable error ?
1462
1463 */
1464 NTSTATUS cli_start_connection(struct cli_state **output_cli,
1465                               const char *my_name,
1466                               const char *dest_host,
1467                               struct in_addr *dest_ip, int port,
1468                               int signing_state, int flags,
1469                               BOOL *retry)
1470 {
1471         NTSTATUS nt_status;
1472         struct nmb_name calling;
1473         struct nmb_name called;
1474         struct cli_state *cli;
1475         struct in_addr ip;
1476
1477         if (retry)
1478                 *retry = False;
1479
1480         if (!my_name)
1481                 my_name = global_myname();
1482
1483         if (!(cli = cli_initialise())) {
1484                 return NT_STATUS_NO_MEMORY;
1485         }
1486
1487         make_nmb_name(&calling, my_name, 0x0);
1488         make_nmb_name(&called , dest_host, 0x20);
1489
1490         if (cli_set_port(cli, port) != port) {
1491                 cli_shutdown(cli);
1492                 return NT_STATUS_UNSUCCESSFUL;
1493         }
1494
1495         cli_set_timeout(cli, 10000); /* 10 seconds. */
1496
1497         if (dest_ip)
1498                 ip = *dest_ip;
1499         else
1500                 ZERO_STRUCT(ip);
1501
1502 again:
1503
1504         DEBUG(3,("Connecting to host=%s\n", dest_host));
1505
1506         if (!cli_connect(cli, dest_host, &ip)) {
1507                 DEBUG(1,("cli_start_connection: failed to connect to %s (%s)\n",
1508                          nmb_namestr(&called), inet_ntoa(ip)));
1509                 cli_shutdown(cli);
1510                 if (is_zero_ip(ip)) {
1511                         return NT_STATUS_BAD_NETWORK_NAME;
1512                 } else {
1513                         return NT_STATUS_CONNECTION_REFUSED;
1514                 }
1515         }
1516
1517         if (retry)
1518                 *retry = True;
1519
1520         if (!cli_session_request(cli, &calling, &called)) {
1521                 char *p;
1522                 DEBUG(1,("session request to %s failed (%s)\n",
1523                          called.name, cli_errstr(cli)));
1524                 if ((p=strchr(called.name, '.')) && !is_ipaddress(called.name)) {
1525                         *p = 0;
1526                         goto again;
1527                 }
1528                 if (strcmp(called.name, "*SMBSERVER")) {
1529                         make_nmb_name(&called , "*SMBSERVER", 0x20);
1530                         goto again;
1531                 }
1532                 return NT_STATUS_BAD_NETWORK_NAME;
1533         }
1534
1535         cli_setup_signing_state(cli, signing_state);
1536
1537         if (flags & CLI_FULL_CONNECTION_DONT_SPNEGO)
1538                 cli->use_spnego = False;
1539         else if (flags & CLI_FULL_CONNECTION_USE_KERBEROS)
1540                 cli->use_kerberos = True;
1541
1542         if (!cli_negprot(cli)) {
1543                 DEBUG(1,("failed negprot\n"));
1544                 nt_status = cli_nt_error(cli);
1545                 if (NT_STATUS_IS_OK(nt_status)) {
1546                         nt_status = NT_STATUS_UNSUCCESSFUL;
1547                 }
1548                 cli_shutdown(cli);
1549                 return nt_status;
1550         }
1551
1552         *output_cli = cli;
1553         return NT_STATUS_OK;
1554 }
1555
1556
1557 /**
1558    establishes a connection right up to doing tconX, password specified.
1559    @param output_cli A fully initialised cli structure, non-null only on success
1560    @param dest_host The netbios name of the remote host
1561    @param dest_ip (optional) The the destination IP, NULL for name based lookup
1562    @param port (optional) The destination port (0 for default)
1563    @param service (optional) The share to make the connection to.  Should be 'unqualified' in any way.
1564    @param service_type The 'type' of serivice.
1565    @param user Username, unix string
1566    @param domain User's domain
1567    @param password User's password, unencrypted unix string.
1568    @param retry BOOL. Did this connection fail with a retryable error ?
1569 */
1570
1571 NTSTATUS cli_full_connection(struct cli_state **output_cli,
1572                              const char *my_name,
1573                              const char *dest_host,
1574                              struct in_addr *dest_ip, int port,
1575                              const char *service, const char *service_type,
1576                              const char *user, const char *domain,
1577                              const char *password, int flags,
1578                              int signing_state,
1579                              BOOL *retry)
1580 {
1581         NTSTATUS nt_status;
1582         struct cli_state *cli = NULL;
1583         int pw_len = password ? strlen(password)+1 : 0;
1584
1585         *output_cli = NULL;
1586
1587         if (password == NULL) {
1588                 password = "";
1589         }
1590
1591         nt_status = cli_start_connection(&cli, my_name, dest_host,
1592                                          dest_ip, port, signing_state, flags, retry);
1593
1594         if (!NT_STATUS_IS_OK(nt_status)) {
1595                 return nt_status;
1596         }
1597
1598         nt_status = cli_session_setup(cli, user, password, pw_len, password,
1599                                       pw_len, domain);
1600         if (!NT_STATUS_IS_OK(nt_status)) {
1601
1602                 if (!(flags & CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK)) {
1603                         DEBUG(1,("failed session setup with %s\n",
1604                                  nt_errstr(nt_status)));
1605                         cli_shutdown(cli);
1606                         return nt_status;
1607                 }
1608
1609                 nt_status = cli_session_setup(cli, "", "", 0, "", 0, domain);
1610                 if (!NT_STATUS_IS_OK(nt_status)) {
1611                         DEBUG(1,("anonymous failed session setup with %s\n",
1612                                  nt_errstr(nt_status)));
1613                         cli_shutdown(cli);
1614                         return nt_status;
1615                 }
1616         }
1617
1618         if (service) {
1619                 if (!cli_send_tconX(cli, service, service_type, password, pw_len)) {
1620                         nt_status = cli_nt_error(cli);
1621                         DEBUG(1,("failed tcon_X with %s\n", nt_errstr(nt_status)));
1622                         cli_shutdown(cli);
1623                         if (NT_STATUS_IS_OK(nt_status)) {
1624                                 nt_status = NT_STATUS_UNSUCCESSFUL;
1625                         }
1626                         return nt_status;
1627                 }
1628         }
1629
1630         cli_init_creds(cli, user, domain, password);
1631
1632         *output_cli = cli;
1633         return NT_STATUS_OK;
1634 }
1635
1636 /****************************************************************************
1637  Attempt a NetBIOS session request, falling back to *SMBSERVER if needed.
1638 ****************************************************************************/
1639
1640 BOOL attempt_netbios_session_request(struct cli_state **ppcli, const char *srchost, const char *desthost,
1641                                      struct in_addr *pdest_ip)
1642 {
1643         struct nmb_name calling, called;
1644
1645         make_nmb_name(&calling, srchost, 0x0);
1646
1647         /*
1648          * If the called name is an IP address
1649          * then use *SMBSERVER immediately.
1650          */
1651
1652         if(is_ipaddress(desthost)) {
1653                 make_nmb_name(&called, "*SMBSERVER", 0x20);
1654         } else {
1655                 make_nmb_name(&called, desthost, 0x20);
1656         }
1657
1658         if (!cli_session_request(*ppcli, &calling, &called)) {
1659                 struct nmb_name smbservername;
1660
1661                 make_nmb_name(&smbservername , "*SMBSERVER", 0x20);
1662
1663                 /*
1664                  * If the name wasn't *SMBSERVER then
1665                  * try with *SMBSERVER if the first name fails.
1666                  */
1667
1668                 if (nmb_name_equal(&called, &smbservername)) {
1669
1670                         /*
1671                          * The name used was *SMBSERVER, don't bother with another name.
1672                          */
1673
1674                         DEBUG(0,("attempt_netbios_session_request: %s rejected the session for name *SMBSERVER \
1675 with error %s.\n", desthost, cli_errstr(*ppcli) ));
1676                         return False;
1677                 }
1678
1679                 /* Try again... */
1680                 cli_shutdown(*ppcli);
1681
1682                 *ppcli = cli_initialise();
1683                 if (!*ppcli) {
1684                         /* Out of memory... */
1685                         return False;
1686                 }
1687
1688                 if (!cli_connect(*ppcli, desthost, pdest_ip) ||
1689                                 !cli_session_request(*ppcli, &calling, &smbservername)) {
1690                         DEBUG(0,("attempt_netbios_session_request: %s rejected the session for \
1691 name *SMBSERVER with error %s\n", desthost, cli_errstr(*ppcli) ));
1692                         return False;
1693                 }
1694         }
1695
1696         return True;
1697 }
1698
1699
1700
1701
1702
1703 /****************************************************************************
1704  Send an old style tcon.
1705 ****************************************************************************/
1706 NTSTATUS cli_raw_tcon(struct cli_state *cli,
1707                       const char *service, const char *pass, const char *dev,
1708                       uint16 *max_xmit, uint16 *tid)
1709 {
1710         char *p;
1711
1712         if (!lp_client_plaintext_auth() && (*pass)) {
1713                 DEBUG(1, ("Server requested plaintext password but 'client use plaintext auth'"
1714                           " is disabled\n"));
1715                 return NT_STATUS_ACCESS_DENIED;
1716         }
1717
1718         memset(cli->outbuf,'\0',smb_size);
1719         memset(cli->inbuf,'\0',smb_size);
1720
1721         set_message(NULL,cli->outbuf, 0, 0, True);
1722         SCVAL(cli->outbuf,smb_com,SMBtcon);
1723         cli_setup_packet(cli);
1724
1725         p = smb_buf(cli->outbuf);
1726         *p++ = 4; p += clistr_push(cli, p, service, -1, STR_TERMINATE | STR_NOALIGN);
1727         *p++ = 4; p += clistr_push(cli, p, pass, -1, STR_TERMINATE | STR_NOALIGN);
1728         *p++ = 4; p += clistr_push(cli, p, dev, -1, STR_TERMINATE | STR_NOALIGN);
1729
1730         cli_setup_bcc(cli, p);
1731
1732         cli_send_smb(cli);
1733         if (!cli_receive_smb(cli)) {
1734                 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
1735         }
1736
1737         if (cli_is_error(cli)) {
1738                 return cli_nt_error(cli);
1739         }
1740
1741         *max_xmit = SVAL(cli->inbuf, smb_vwv0);
1742         *tid = SVAL(cli->inbuf, smb_vwv1);
1743
1744         return NT_STATUS_OK;
1745 }
1746
1747 /* Return a cli_state pointing at the IPC$ share for the given server */
1748
1749 struct cli_state *get_ipc_connect(char *server, struct in_addr *server_ip,
1750                                          struct user_auth_info *user_info)
1751 {
1752         struct cli_state *cli;
1753         pstring myname;
1754         NTSTATUS nt_status;
1755
1756         get_myname(myname);
1757
1758         nt_status = cli_full_connection(&cli, myname, server, server_ip, 0, "IPC$", "IPC",
1759                                         user_info->username, lp_workgroup(), user_info->password,
1760                                         CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK, Undefined, NULL);
1761
1762         if (NT_STATUS_IS_OK(nt_status)) {
1763                 return cli;
1764         } else if (is_ipaddress(server)) {
1765             /* windows 9* needs a correct NMB name for connections */
1766             fstring remote_name;
1767
1768             if (name_status_find("*", 0, 0, *server_ip, remote_name)) {
1769                 cli = get_ipc_connect(remote_name, server_ip, user_info);
1770                 if (cli)
1771                     return cli;
1772             }
1773         }
1774         return NULL;
1775 }
1776
1777 /*
1778  * Given the IP address of a master browser on the network, return its
1779  * workgroup and connect to it.
1780  *
1781  * This function is provided to allow additional processing beyond what
1782  * get_ipc_connect_master_ip_bcast() does, e.g. to retrieve the list of master
1783  * browsers and obtain each master browsers' list of domains (in case the
1784  * first master browser is recently on the network and has not yet
1785  * synchronized with other master browsers and therefore does not yet have the
1786  * entire network browse list)
1787  */
1788
1789 struct cli_state *get_ipc_connect_master_ip(struct ip_service * mb_ip, pstring workgroup, struct user_auth_info *user_info)
1790 {
1791         static fstring name;
1792         struct cli_state *cli;
1793         struct in_addr server_ip;
1794
1795         DEBUG(99, ("Looking up name of master browser %s\n",
1796                    inet_ntoa(mb_ip->ip)));
1797
1798         /*
1799          * Do a name status query to find out the name of the master browser.
1800          * We use <01><02>__MSBROWSE__<02>#01 if *#00 fails because a domain
1801          * master browser will not respond to a wildcard query (or, at least,
1802          * an NT4 server acting as the domain master browser will not).
1803          *
1804          * We might be able to use ONLY the query on MSBROWSE, but that's not
1805          * yet been tested with all Windows versions, so until it is, leave
1806          * the original wildcard query as the first choice and fall back to
1807          * MSBROWSE if the wildcard query fails.
1808          */
1809         if (!name_status_find("*", 0, 0x1d, mb_ip->ip, name) &&
1810             !name_status_find(MSBROWSE, 1, 0x1d, mb_ip->ip, name)) {
1811
1812                 DEBUG(99, ("Could not retrieve name status for %s\n",
1813                            inet_ntoa(mb_ip->ip)));
1814                 return NULL;
1815         }
1816
1817         if (!find_master_ip(name, &server_ip)) {
1818                 DEBUG(99, ("Could not find master ip for %s\n", name));
1819                 return NULL;
1820         }
1821
1822                 pstrcpy(workgroup, name);
1823
1824                 DEBUG(4, ("found master browser %s, %s\n",
1825                   name, inet_ntoa(mb_ip->ip)));
1826
1827                 cli = get_ipc_connect(inet_ntoa(server_ip), &server_ip, user_info);
1828
1829                 return cli;
1830
1831 }
1832
1833 /*
1834  * Return the IP address and workgroup of a master browser on the network, and
1835  * connect to it.
1836  */
1837
1838 struct cli_state *get_ipc_connect_master_ip_bcast(pstring workgroup, struct user_auth_info *user_info)
1839 {
1840         struct ip_service *ip_list;
1841         struct cli_state *cli;
1842         int i, count;
1843
1844         DEBUG(99, ("Do broadcast lookup for workgroups on local network\n"));
1845
1846         /* Go looking for workgroups by broadcasting on the local network */
1847
1848         if (!name_resolve_bcast(MSBROWSE, 1, &ip_list, &count)) {
1849                 DEBUG(99, ("No master browsers responded\n"));
1850                 return False;
1851         }
1852
1853         for (i = 0; i < count; i++) {
1854             DEBUG(99, ("Found master browser %s\n", inet_ntoa(ip_list[i].ip)));
1855
1856             cli = get_ipc_connect_master_ip(&ip_list[i], workgroup, user_info);
1857             if (cli)
1858                     return(cli);
1859         }
1860
1861         return NULL;
1862 }