source3/libsmb/cliconnect.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    client connect/disconnect routines
   4    Copyright (C) Andrew Tridgell 1994-1998
   5    Copyright (C) Andrew Bartlett 2001-2003
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "../libcli/auth/libcli_auth.h"
  23 #include "../libcli/auth/spnego.h"
  24 #include "smb_krb5.h"
  25 #include "ntlmssp.h"
  26
  27 static const struct {
  28         int prot;
  29         const char name[24];
  30 } prots[10] = {
  31         {PROTOCOL_CORE,         "PC NETWORK PROGRAM 1.0"},
  32         {PROTOCOL_COREPLUS,     "MICROSOFT NETWORKS 1.03"},
  33         {PROTOCOL_LANMAN1,      "MICROSOFT NETWORKS 3.0"},
  34         {PROTOCOL_LANMAN1,      "LANMAN1.0"},
  35         {PROTOCOL_LANMAN2,      "LM1.2X002"},
  36         {PROTOCOL_LANMAN2,      "DOS LANMAN2.1"},
  37         {PROTOCOL_LANMAN2,      "LANMAN2.1"},
  38         {PROTOCOL_LANMAN2,      "Samba"},
  39         {PROTOCOL_NT1,          "NT LANMAN 1.0"},
  40         {PROTOCOL_NT1,          "NT LM 0.12"},
  41 };
  42
  43 #define STAR_SMBSERVER "*SMBSERVER"
  44
  45 /**
  46  * Set the user session key for a connection
  47  * @param cli The cli structure to add it too
  48  * @param session_key The session key used.  (A copy of this is taken for the cli struct)
  49  *
  50  */
  51
  52 static void cli_set_session_key (struct cli_state *cli, const DATA_BLOB session_key)
  53 {
  54         cli->user_session_key = data_blob(session_key.data, session_key.length);
  55 }
  56
  57 /****************************************************************************
  58  Do an old lanman2 style session setup.
  59 ****************************************************************************/
  60
  61 static NTSTATUS cli_session_setup_lanman2(struct cli_state *cli,
  62                                           const char *user,
  63                                           const char *pass, size_t passlen,
  64                                           const char *workgroup)
  65 {
  66         DATA_BLOB session_key = data_blob_null;
  67         DATA_BLOB lm_response = data_blob_null;
  68         NTSTATUS status;
  69         fstring pword;
  70         char *p;
  71
  72         if (passlen > sizeof(pword)-1) {
  73                 return NT_STATUS_INVALID_PARAMETER;
  74         }
  75
  76         /* LANMAN servers predate NT status codes and Unicode and ignore those
  77            smb flags so we must disable the corresponding default capabilities
  78            that would otherwise cause the Unicode and NT Status flags to be
  79            set (and even returned by the server) */
  80
  81         cli->capabilities &= ~(CAP_UNICODE | CAP_STATUS32);
  82
  83         /* if in share level security then don't send a password now */
  84         if (!(cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL))
  85                 passlen = 0;
  86
  87         if (passlen > 0 && (cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) && passlen != 24) {
  88                 /* Encrypted mode needed, and non encrypted password supplied. */
  89                 lm_response = data_blob(NULL, 24);
  90                 if (!SMBencrypt(pass, cli->secblob.data,(uchar *)lm_response.data)) {
  91                         DEBUG(1, ("Password is > 14 chars in length, and is therefore incompatible with Lanman authentication\n"));
  92                         return NT_STATUS_ACCESS_DENIED;
  93                 }
  94         } else if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) && passlen == 24) {
  95                 /* Encrypted mode needed, and encrypted password supplied. */
  96                 lm_response = data_blob(pass, passlen);
  97         } else if (passlen > 0) {
  98                 /* Plaintext mode needed, assume plaintext supplied. */
  99                 passlen = clistr_push(cli, pword, pass, sizeof(pword), STR_TERMINATE);
 100                 lm_response = data_blob(pass, passlen);
 101         }
 102
 103         /* send a session setup command */
 104         memset(cli->outbuf,'\0',smb_size);
 105         cli_set_message(cli->outbuf,10, 0, True);
 106         SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
 107         cli_setup_packet(cli);
 108
 109         SCVAL(cli->outbuf,smb_vwv0,0xFF);
 110         SSVAL(cli->outbuf,smb_vwv2,cli->max_xmit);
 111         SSVAL(cli->outbuf,smb_vwv3,2);
 112         SSVAL(cli->outbuf,smb_vwv4,1);
 113         SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
 114         SSVAL(cli->outbuf,smb_vwv7,lm_response.length);
 115
 116         p = smb_buf(cli->outbuf);
 117         memcpy(p,lm_response.data,lm_response.length);
 118         p += lm_response.length;
 119         p += clistr_push(cli, p, user, -1, STR_TERMINATE|STR_UPPER);
 120         p += clistr_push(cli, p, workgroup, -1, STR_TERMINATE|STR_UPPER);
 121         p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
 122         p += clistr_push(cli, p, "Samba", -1, STR_TERMINATE);
 123         cli_setup_bcc(cli, p);
 124
 125         if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
 126                 return cli_nt_error(cli);
 127         }
 128
 129         show_msg(cli->inbuf);
 130
 131         if (cli_is_error(cli)) {
 132                 return cli_nt_error(cli);
 133         }
 134
 135         /* use the returned vuid from now on */
 136         cli->vuid = SVAL(cli->inbuf,smb_uid);
 137         status = cli_set_username(cli, user);
 138         if (!NT_STATUS_IS_OK(status)) {
 139                 return status;
 140         }
 141
 142         if (session_key.data) {
 143                 /* Have plaintext orginal */
 144                 cli_set_session_key(cli, session_key);
 145         }
 146
 147         return NT_STATUS_OK;
 148 }
 149
 150 /****************************************************************************
 151  Work out suitable capabilities to offer the server.
 152 ****************************************************************************/
 153
 154 static uint32 cli_session_setup_capabilities(struct cli_state *cli)
 155 {
 156         uint32 capabilities = CAP_NT_SMBS;
 157
 158         if (!cli->force_dos_errors)
 159                 capabilities |= CAP_STATUS32;
 160
 161         if (cli->use_level_II_oplocks)
 162                 capabilities |= CAP_LEVEL_II_OPLOCKS;
 163
 164         capabilities |= (cli->capabilities & (CAP_UNICODE|CAP_LARGE_FILES|CAP_LARGE_READX|CAP_LARGE_WRITEX|CAP_DFS));
 165         return capabilities;
 166 }
 167
 168 /****************************************************************************
 169  Do a NT1 guest session setup.
 170 ****************************************************************************/
 171
 172 struct cli_session_setup_guest_state {
 173         struct cli_state *cli;
 174         uint16_t vwv[16];
 175         struct iovec bytes;
 176 };
 177
 178 static void cli_session_setup_guest_done(struct tevent_req *subreq);
 179
 180 struct tevent_req *cli_session_setup_guest_create(TALLOC_CTX *mem_ctx,
 181                                                   struct event_context *ev,
 182                                                   struct cli_state *cli,
 183                                                   struct tevent_req **psmbreq)
 184 {
 185         struct tevent_req *req, *subreq;
 186         struct cli_session_setup_guest_state *state;
 187         uint16_t *vwv;
 188         uint8_t *bytes;
 189
 190         req = tevent_req_create(mem_ctx, &state,
 191                                 struct cli_session_setup_guest_state);
 192         if (req == NULL) {
 193                 return NULL;
 194         }
 195         state->cli = cli;
 196         vwv = state->vwv;
 197
 198         SCVAL(vwv+0, 0, 0xFF);
 199         SCVAL(vwv+0, 1, 0);
 200         SSVAL(vwv+1, 0, 0);
 201         SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
 202         SSVAL(vwv+3, 0, 2);
 203         SSVAL(vwv+4, 0, cli->pid);
 204         SIVAL(vwv+5, 0, cli->sesskey);
 205         SSVAL(vwv+7, 0, 0);
 206         SSVAL(vwv+8, 0, 0);
 207         SSVAL(vwv+9, 0, 0);
 208         SSVAL(vwv+10, 0, 0);
 209         SIVAL(vwv+11, 0, cli_session_setup_capabilities(cli));
 210
 211         bytes = talloc_array(state, uint8_t, 0);
 212
 213         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "",  1, /* username */
 214                                    NULL);
 215         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "", 1, /* workgroup */
 216                                    NULL);
 217         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Unix", 5, NULL);
 218         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Samba", 6, NULL);
 219
 220         if (bytes == NULL) {
 221                 TALLOC_FREE(req);
 222                 return NULL;
 223         }
 224
 225         state->bytes.iov_base = (void *)bytes;
 226         state->bytes.iov_len = talloc_get_size(bytes);
 227
 228         subreq = cli_smb_req_create(state, ev, cli, SMBsesssetupX, 0, 13, vwv,
 229                                     1, &state->bytes);
 230         if (subreq == NULL) {
 231                 TALLOC_FREE(req);
 232                 return NULL;
 233         }
 234         tevent_req_set_callback(subreq, cli_session_setup_guest_done, req);
 235         *psmbreq = subreq;
 236         return req;
 237 }
 238
 239 struct tevent_req *cli_session_setup_guest_send(TALLOC_CTX *mem_ctx,
 240                                                 struct event_context *ev,
 241                                                 struct cli_state *cli)
 242 {
 243         struct tevent_req *req, *subreq;
 244         NTSTATUS status;
 245
 246         req = cli_session_setup_guest_create(mem_ctx, ev, cli, &subreq);
 247         if (req == NULL) {
 248                 return NULL;
 249         }
 250
 251         status = cli_smb_req_send(subreq);
 252         if (NT_STATUS_IS_OK(status)) {
 253                 tevent_req_nterror(req, status);
 254                 return tevent_req_post(req, ev);
 255         }
 256         return req;
 257 }
 258
 259 static void cli_session_setup_guest_done(struct tevent_req *subreq)
 260 {
 261         struct tevent_req *req = tevent_req_callback_data(
 262                 subreq, struct tevent_req);
 263         struct cli_session_setup_guest_state *state = tevent_req_data(
 264                 req, struct cli_session_setup_guest_state);
 265         struct cli_state *cli = state->cli;
 266         uint32_t num_bytes;
 267         char *inbuf;
 268         uint8_t *bytes;
 269         uint8_t *p;
 270         NTSTATUS status;
 271
 272         status = cli_smb_recv(subreq, 0, NULL, NULL, &num_bytes, &bytes);
 273         if (!NT_STATUS_IS_OK(status)) {
 274                 TALLOC_FREE(subreq);
 275                 tevent_req_nterror(req, status);
 276                 return;
 277         }
 278
 279         inbuf = (char *)cli_smb_inbuf(subreq);
 280         p = bytes;
 281
 282         cli->vuid = SVAL(inbuf, smb_uid);
 283
 284         p += clistr_pull(inbuf, cli->server_os, (char *)p, sizeof(fstring),
 285                          bytes+num_bytes-p, STR_TERMINATE);
 286         p += clistr_pull(inbuf, cli->server_type, (char *)p, sizeof(fstring),
 287                          bytes+num_bytes-p, STR_TERMINATE);
 288         p += clistr_pull(inbuf, cli->server_domain, (char *)p, sizeof(fstring),
 289                          bytes+num_bytes-p, STR_TERMINATE);
 290
 291         if (strstr(cli->server_type, "Samba")) {
 292                 cli->is_samba = True;
 293         }
 294
 295         TALLOC_FREE(subreq);
 296
 297         status = cli_set_username(cli, "");
 298         if (!NT_STATUS_IS_OK(status)) {
 299                 tevent_req_nterror(req, status);
 300                 return;
 301         }
 302         tevent_req_done(req);
 303 }
 304
 305 NTSTATUS cli_session_setup_guest_recv(struct tevent_req *req)
 306 {
 307         return tevent_req_simple_recv_ntstatus(req);
 308 }
 309
 310 static NTSTATUS cli_session_setup_guest(struct cli_state *cli)
 311 {
 312         TALLOC_CTX *frame = talloc_stackframe();
 313         struct event_context *ev;
 314         struct tevent_req *req;
 315         NTSTATUS status = NT_STATUS_OK;
 316
 317         if (cli_has_async_calls(cli)) {
 318                 /*
 319                  * Can't use sync call while an async call is in flight
 320                  */
 321                 status = NT_STATUS_INVALID_PARAMETER;
 322                 goto fail;
 323         }
 324
 325         ev = event_context_init(frame);
 326         if (ev == NULL) {
 327                 status = NT_STATUS_NO_MEMORY;
 328                 goto fail;
 329         }
 330
 331         req = cli_session_setup_guest_send(frame, ev, cli);
 332         if (req == NULL) {
 333                 status = NT_STATUS_NO_MEMORY;
 334                 goto fail;
 335         }
 336
 337         if (!tevent_req_poll(req, ev)) {
 338                 status = map_nt_error_from_unix(errno);
 339                 goto fail;
 340         }
 341
 342         status = cli_session_setup_guest_recv(req);
 343  fail:
 344         TALLOC_FREE(frame);
 345         if (!NT_STATUS_IS_OK(status)) {
 346                 cli_set_error(cli, status);
 347         }
 348         return status;
 349 }
 350
 351 /****************************************************************************
 352  Do a NT1 plaintext session setup.
 353 ****************************************************************************/
 354
 355 static NTSTATUS cli_session_setup_plaintext(struct cli_state *cli,
 356                                             const char *user, const char *pass,
 357                                             const char *workgroup)
 358 {
 359         uint32 capabilities = cli_session_setup_capabilities(cli);
 360         char *p;
 361         NTSTATUS status;
 362         fstring lanman;
 363
 364         fstr_sprintf( lanman, "Samba %s", samba_version_string());
 365
 366         memset(cli->outbuf, '\0', smb_size);
 367         cli_set_message(cli->outbuf,13,0,True);
 368         SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
 369         cli_setup_packet(cli);
 370
 371         SCVAL(cli->outbuf,smb_vwv0,0xFF);
 372         SSVAL(cli->outbuf,smb_vwv2,CLI_BUFFER_SIZE);
 373         SSVAL(cli->outbuf,smb_vwv3,2);
 374         SSVAL(cli->outbuf,smb_vwv4,cli->pid);
 375         SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
 376         SSVAL(cli->outbuf,smb_vwv8,0);
 377         SIVAL(cli->outbuf,smb_vwv11,capabilities);
 378         p = smb_buf(cli->outbuf);
 379
 380         /* check wether to send the ASCII or UNICODE version of the password */
 381
 382         if ( (capabilities & CAP_UNICODE) == 0 ) {
 383                 p += clistr_push(cli, p, pass, -1, STR_TERMINATE); /* password */
 384                 SSVAL(cli->outbuf,smb_vwv7,PTR_DIFF(p, smb_buf(cli->outbuf)));
 385         }
 386         else {
 387                 /* For ucs2 passwords clistr_push calls ucs2_align, which causes
 388                  * the space taken by the unicode password to be one byte too
 389                  * long (as we're on an odd byte boundary here). Reduce the
 390                  * count by 1 to cope with this. Fixes smbclient against NetApp
 391                  * servers which can't cope. Fix from
 392                  * bryan.kolodziej@allenlund.com in bug #3840.
 393                  */
 394                 p += clistr_push(cli, p, pass, -1, STR_UNICODE|STR_TERMINATE); /* unicode password */
 395                 SSVAL(cli->outbuf,smb_vwv8,PTR_DIFF(p, smb_buf(cli->outbuf))-1);
 396         }
 397
 398         p += clistr_push(cli, p, user, -1, STR_TERMINATE); /* username */
 399         p += clistr_push(cli, p, workgroup, -1, STR_TERMINATE); /* workgroup */
 400         p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
 401         p += clistr_push(cli, p, lanman, -1, STR_TERMINATE);
 402         cli_setup_bcc(cli, p);
 403
 404         if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
 405                 return cli_nt_error(cli);
 406         }
 407
 408         show_msg(cli->inbuf);
 409
 410         if (cli_is_error(cli)) {
 411                 return cli_nt_error(cli);
 412         }
 413
 414         cli->vuid = SVAL(cli->inbuf,smb_uid);
 415         p = smb_buf(cli->inbuf);
 416         p += clistr_pull(cli->inbuf, cli->server_os, p, sizeof(fstring),
 417                          -1, STR_TERMINATE);
 418         p += clistr_pull(cli->inbuf, cli->server_type, p, sizeof(fstring),
 419                          -1, STR_TERMINATE);
 420         p += clistr_pull(cli->inbuf, cli->server_domain, p, sizeof(fstring),
 421                          -1, STR_TERMINATE);
 422         status = cli_set_username(cli, user);
 423         if (!NT_STATUS_IS_OK(status)) {
 424                 return status;
 425         }
 426         if (strstr(cli->server_type, "Samba")) {
 427                 cli->is_samba = True;
 428         }
 429
 430         return NT_STATUS_OK;
 431 }
 432
 433 /****************************************************************************
 434    do a NT1 NTLM/LM encrypted session setup - for when extended security
 435    is not negotiated.
 436    @param cli client state to create do session setup on
 437    @param user username
 438    @param pass *either* cleartext password (passlen !=24) or LM response.
 439    @param ntpass NT response, implies ntpasslen >=24, implies pass is not clear
 440    @param workgroup The user's domain.
 441 ****************************************************************************/
 442
 443 static NTSTATUS cli_session_setup_nt1(struct cli_state *cli, const char *user,
 444                                       const char *pass, size_t passlen,
 445                                       const char *ntpass, size_t ntpasslen,
 446                                       const char *workgroup)
 447 {
 448         uint32 capabilities = cli_session_setup_capabilities(cli);
 449         DATA_BLOB lm_response = data_blob_null;
 450         DATA_BLOB nt_response = data_blob_null;
 451         DATA_BLOB session_key = data_blob_null;
 452         NTSTATUS result;
 453         char *p;
 454         bool ok;
 455
 456         if (passlen == 0) {
 457                 /* do nothing - guest login */
 458         } else if (passlen != 24) {
 459                 if (lp_client_ntlmv2_auth()) {
 460                         DATA_BLOB server_chal;
 461                         DATA_BLOB names_blob;
 462                         server_chal = data_blob(cli->secblob.data, MIN(cli->secblob.length, 8));
 463
 464                         /* note that the 'workgroup' here is a best guess - we don't know
 465                            the server's domain at this point.  The 'server name' is also
 466                            dodgy...
 467                         */
 468                         names_blob = NTLMv2_generate_names_blob(NULL, cli->called.name, workgroup);
 469
 470                         if (!SMBNTLMv2encrypt(NULL, user, workgroup, pass, &server_chal,
 471                                               &names_blob,
 472                                               &lm_response, &nt_response, NULL, &session_key)) {
 473                                 data_blob_free(&names_blob);
 474                                 data_blob_free(&server_chal);
 475                                 return NT_STATUS_ACCESS_DENIED;
 476                         }
 477                         data_blob_free(&names_blob);
 478                         data_blob_free(&server_chal);
 479
 480                 } else {
 481                         uchar nt_hash[16];
 482                         E_md4hash(pass, nt_hash);
 483
 484 #ifdef LANMAN_ONLY
 485                         nt_response = data_blob_null;
 486 #else
 487                         nt_response = data_blob(NULL, 24);
 488                         SMBNTencrypt(pass,cli->secblob.data,nt_response.data);
 489 #endif
 490                         /* non encrypted password supplied. Ignore ntpass. */
 491                         if (lp_client_lanman_auth()) {
 492                                 lm_response = data_blob(NULL, 24);
 493                                 if (!SMBencrypt(pass,cli->secblob.data, lm_response.data)) {
 494                                         /* Oops, the LM response is invalid, just put
 495                                            the NT response there instead */
 496                                         data_blob_free(&lm_response);
 497                                         lm_response = data_blob(nt_response.data, nt_response.length);
 498                                 }
 499                         } else {
 500                                 /* LM disabled, place NT# in LM field instead */
 501                                 lm_response = data_blob(nt_response.data, nt_response.length);
 502                         }
 503
 504                         session_key = data_blob(NULL, 16);
 505 #ifdef LANMAN_ONLY
 506                         E_deshash(pass, session_key.data);
 507                         memset(&session_key.data[8], '\0', 8);
 508 #else
 509                         SMBsesskeygen_ntv1(nt_hash, session_key.data);
 510 #endif
 511                 }
 512                 cli_temp_set_signing(cli);
 513         } else {
 514                 /* pre-encrypted password supplied.  Only used for
 515                    security=server, can't do
 516                    signing because we don't have original key */
 517
 518                 lm_response = data_blob(pass, passlen);
 519                 nt_response = data_blob(ntpass, ntpasslen);
 520         }
 521
 522         /* send a session setup command */
 523         memset(cli->outbuf,'\0',smb_size);
 524
 525         cli_set_message(cli->outbuf,13,0,True);
 526         SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
 527         cli_setup_packet(cli);
 528
 529         SCVAL(cli->outbuf,smb_vwv0,0xFF);
 530         SSVAL(cli->outbuf,smb_vwv2,CLI_BUFFER_SIZE);
 531         SSVAL(cli->outbuf,smb_vwv3,2);
 532         SSVAL(cli->outbuf,smb_vwv4,cli->pid);
 533         SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
 534         SSVAL(cli->outbuf,smb_vwv7,lm_response.length);
 535         SSVAL(cli->outbuf,smb_vwv8,nt_response.length);
 536         SIVAL(cli->outbuf,smb_vwv11,capabilities);
 537         p = smb_buf(cli->outbuf);
 538         if (lm_response.length) {
 539                 memcpy(p,lm_response.data, lm_response.length); p += lm_response.length;
 540         }
 541         if (nt_response.length) {
 542                 memcpy(p,nt_response.data, nt_response.length); p += nt_response.length;
 543         }
 544         p += clistr_push(cli, p, user, -1, STR_TERMINATE);
 545
 546         /* Upper case here might help some NTLMv2 implementations */
 547         p += clistr_push(cli, p, workgroup, -1, STR_TERMINATE|STR_UPPER);
 548         p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
 549         p += clistr_push(cli, p, "Samba", -1, STR_TERMINATE);
 550         cli_setup_bcc(cli, p);
 551
 552         if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
 553                 result = cli_nt_error(cli);
 554                 goto end;
 555         }
 556
 557         /* show_msg(cli->inbuf); */
 558
 559         if (cli_is_error(cli)) {
 560                 result = cli_nt_error(cli);
 561                 goto end;
 562         }
 563
 564 #ifdef LANMAN_ONLY
 565         ok = cli_simple_set_signing(cli, session_key, lm_response);
 566 #else
 567         ok = cli_simple_set_signing(cli, session_key, nt_response);
 568 #endif
 569         if (ok) {
 570                 if (!cli_check_sign_mac(cli, cli->inbuf, 1)) {
 571                         result = NT_STATUS_ACCESS_DENIED;
 572                         goto end;
 573                 }
 574         }
 575
 576         /* use the returned vuid from now on */
 577         cli->vuid = SVAL(cli->inbuf,smb_uid);
 578
 579         p = smb_buf(cli->inbuf);
 580         p += clistr_pull(cli->inbuf, cli->server_os, p, sizeof(fstring),
 581                          -1, STR_TERMINATE);
 582         p += clistr_pull(cli->inbuf, cli->server_type, p, sizeof(fstring),
 583                          -1, STR_TERMINATE);
 584         p += clistr_pull(cli->inbuf, cli->server_domain, p, sizeof(fstring),
 585                          -1, STR_TERMINATE);
 586
 587         if (strstr(cli->server_type, "Samba")) {
 588                 cli->is_samba = True;
 589         }
 590
 591         result = cli_set_username(cli, user);
 592         if (!NT_STATUS_IS_OK(result)) {
 593                 goto end;
 594         }
 595
 596         if (session_key.data) {
 597                 /* Have plaintext orginal */
 598                 cli_set_session_key(cli, session_key);
 599         }
 600
 601         result = NT_STATUS_OK;
 602 end:
 603         data_blob_free(&lm_response);
 604         data_blob_free(&nt_response);
 605         data_blob_free(&session_key);
 606         return result;
 607 }
 608
 609 /* The following is calculated from :
 610  * (smb_size-4) = 35
 611  * (smb_wcnt * 2) = 24 (smb_wcnt == 12 in cli_session_setup_blob_send() )
 612  * (strlen("Unix") + 1 + strlen("Samba") + 1) * 2 = 22 (unicode strings at
 613  * end of packet.
 614  */
 615
 616 #define BASE_SESSSETUP_BLOB_PACKET_SIZE (35 + 24 + 22)
 617
 618 struct cli_sesssetup_blob_state {
 619         struct tevent_context *ev;
 620         struct cli_state *cli;
 621         DATA_BLOB blob;
 622         uint16_t max_blob_size;
 623         uint16_t vwv[12];
 624         uint8_t *buf;
 625
 626         NTSTATUS status;
 627         char *inbuf;
 628         DATA_BLOB ret_blob;
 629 };
 630
 631 static bool cli_sesssetup_blob_next(struct cli_sesssetup_blob_state *state,
 632                                     struct tevent_req **psubreq);
 633 static void cli_sesssetup_blob_done(struct tevent_req *subreq);
 634
 635 static struct tevent_req *cli_sesssetup_blob_send(TALLOC_CTX *mem_ctx,
 636                                                   struct tevent_context *ev,
 637                                                   struct cli_state *cli,
 638                                                   DATA_BLOB blob)
 639 {
 640         struct tevent_req *req, *subreq;
 641         struct cli_sesssetup_blob_state *state;
 642
 643         req = tevent_req_create(mem_ctx, &state,
 644                                 struct cli_sesssetup_blob_state);
 645         if (req == NULL) {
 646                 return NULL;
 647         }
 648         state->ev = ev;
 649         state->blob = blob;
 650         state->cli = cli;
 651
 652         if (cli->max_xmit < BASE_SESSSETUP_BLOB_PACKET_SIZE + 1) {
 653                 DEBUG(1, ("cli_session_setup_blob: cli->max_xmit too small "
 654                           "(was %u, need minimum %u)\n",
 655                           (unsigned int)cli->max_xmit,
 656                           BASE_SESSSETUP_BLOB_PACKET_SIZE));
 657                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 658                 return tevent_req_post(req, ev);
 659         }
 660         state->max_blob_size =
 661                 MIN(cli->max_xmit - BASE_SESSSETUP_BLOB_PACKET_SIZE, 0xFFFF);
 662
 663         if (!cli_sesssetup_blob_next(state, &subreq)) {
 664                 tevent_req_nomem(NULL, req);
 665                 return tevent_req_post(req, ev);
 666         }
 667         tevent_req_set_callback(subreq, cli_sesssetup_blob_done, req);
 668         return req;
 669 }
 670
 671 static bool cli_sesssetup_blob_next(struct cli_sesssetup_blob_state *state,
 672                                     struct tevent_req **psubreq)
 673 {
 674         struct tevent_req *subreq;
 675         uint16_t thistime;
 676
 677         SCVAL(state->vwv+0, 0, 0xFF);
 678         SCVAL(state->vwv+0, 1, 0);
 679         SSVAL(state->vwv+1, 0, 0);
 680         SSVAL(state->vwv+2, 0, CLI_BUFFER_SIZE);
 681         SSVAL(state->vwv+3, 0, 2);
 682         SSVAL(state->vwv+4, 0, 1);
 683         SIVAL(state->vwv+5, 0, 0);
 684
 685         thistime = MIN(state->blob.length, state->max_blob_size);
 686         SSVAL(state->vwv+7, 0, thistime);
 687
 688         SSVAL(state->vwv+8, 0, 0);
 689         SSVAL(state->vwv+9, 0, 0);
 690         SIVAL(state->vwv+10, 0,
 691               cli_session_setup_capabilities(state->cli)
 692               | CAP_EXTENDED_SECURITY);
 693
 694         state->buf = (uint8_t *)talloc_memdup(state, state->blob.data,
 695                                               thistime);
 696         if (state->buf == NULL) {
 697                 return false;
 698         }
 699         state->blob.data += thistime;
 700         state->blob.length -= thistime;
 701
 702         state->buf = smb_bytes_push_str(state->buf, cli_ucs2(state->cli),
 703                                         "Unix", 5, NULL);
 704         state->buf = smb_bytes_push_str(state->buf, cli_ucs2(state->cli),
 705                                         "Samba", 6, NULL);
 706         if (state->buf == NULL) {
 707                 return false;
 708         }
 709         subreq = cli_smb_send(state, state->ev, state->cli, SMBsesssetupX, 0,
 710                               12, state->vwv,
 711                               talloc_get_size(state->buf), state->buf);
 712         if (subreq == NULL) {
 713                 return false;
 714         }
 715         *psubreq = subreq;
 716         return true;
 717 }
 718
 719 static void cli_sesssetup_blob_done(struct tevent_req *subreq)
 720 {
 721         struct tevent_req *req = tevent_req_callback_data(
 722                 subreq, struct tevent_req);
 723         struct cli_sesssetup_blob_state *state = tevent_req_data(
 724                 req, struct cli_sesssetup_blob_state);
 725         struct cli_state *cli = state->cli;
 726         uint8_t wct;
 727         uint16_t *vwv;
 728         uint32_t num_bytes;
 729         uint8_t *bytes;
 730         NTSTATUS status;
 731         uint8_t *p;
 732         uint16_t blob_length;
 733
 734         status = cli_smb_recv(subreq, 1, &wct, &vwv, &num_bytes, &bytes);
 735         if (!NT_STATUS_IS_OK(status)
 736             && !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 737                 TALLOC_FREE(subreq);
 738                 tevent_req_nterror(req, status);
 739                 return;
 740         }
 741
 742         state->status = status;
 743         TALLOC_FREE(state->buf);
 744
 745         state->inbuf = (char *)cli_smb_inbuf(subreq);
 746         cli->vuid = SVAL(state->inbuf, smb_uid);
 747
 748         blob_length = SVAL(vwv+3, 0);
 749         if (blob_length > num_bytes) {
 750                 TALLOC_FREE(subreq);
 751                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
 752                 return;
 753         }
 754         state->ret_blob = data_blob_const(bytes, blob_length);
 755
 756         p = bytes + blob_length;
 757
 758         p += clistr_pull(state->inbuf, cli->server_os,
 759                          (char *)p, sizeof(fstring),
 760                          bytes+num_bytes-p, STR_TERMINATE);
 761         p += clistr_pull(state->inbuf, cli->server_type,
 762                          (char *)p, sizeof(fstring),
 763                          bytes+num_bytes-p, STR_TERMINATE);
 764         p += clistr_pull(state->inbuf, cli->server_domain,
 765                          (char *)p, sizeof(fstring),
 766                          bytes+num_bytes-p, STR_TERMINATE);
 767
 768         if (strstr(cli->server_type, "Samba")) {
 769                 cli->is_samba = True;
 770         }
 771
 772         if (state->blob.length != 0) {
 773                 TALLOC_FREE(subreq);
 774                 /*
 775                  * More to send
 776                  */
 777                 if (!cli_sesssetup_blob_next(state, &subreq)) {
 778                         tevent_req_nomem(NULL, req);
 779                         return;
 780                 }
 781                 tevent_req_set_callback(subreq, cli_sesssetup_blob_done, req);
 782                 return;
 783         }
 784         tevent_req_done(req);
 785 }
 786
 787 static NTSTATUS cli_sesssetup_blob_recv(struct tevent_req *req,
 788                                         TALLOC_CTX *mem_ctx,
 789                                         DATA_BLOB *pblob,
 790                                         char **pinbuf)
 791 {
 792         struct cli_sesssetup_blob_state *state = tevent_req_data(
 793                 req, struct cli_sesssetup_blob_state);
 794         NTSTATUS status;
 795         char *inbuf;
 796
 797         if (tevent_req_is_nterror(req, &status)) {
 798                 state->cli->vuid = 0;
 799                 return status;
 800         }
 801
 802         inbuf = talloc_move(mem_ctx, &state->inbuf);
 803         if (pblob != NULL) {
 804                 *pblob = state->ret_blob;
 805         }
 806         if (pinbuf != NULL) {
 807                 *pinbuf = inbuf;
 808         }
 809         /* could be NT_STATUS_MORE_PROCESSING_REQUIRED */
 810         return state->status;
 811 }
 812
 813 #ifdef HAVE_KRB5
 814
 815 /****************************************************************************
 816  Use in-memory credentials cache
 817 ****************************************************************************/
 818
 819 static void use_in_memory_ccache(void) {
 820         setenv(KRB5_ENV_CCNAME, "MEMORY:cliconnect", 1);
 821 }
 822
 823 /****************************************************************************
 824  Do a spnego/kerberos encrypted session setup.
 825 ****************************************************************************/
 826
 827 struct cli_session_setup_kerberos_state {
 828         struct cli_state *cli;
 829         DATA_BLOB negTokenTarg;
 830         DATA_BLOB session_key_krb5;
 831         ADS_STATUS ads_status;
 832 };
 833
 834 static void cli_session_setup_kerberos_done(struct tevent_req *subreq);
 835
 836 static struct tevent_req *cli_session_setup_kerberos_send(
 837         TALLOC_CTX *mem_ctx, struct tevent_context *ev, struct cli_state *cli,
 838         const char *principal, const char *workgroup)
 839 {
 840         struct tevent_req *req, *subreq;
 841         struct cli_session_setup_kerberos_state *state;
 842         int rc;
 843
 844         DEBUG(2,("Doing kerberos session setup\n"));
 845
 846         req = tevent_req_create(mem_ctx, &state,
 847                                 struct cli_session_setup_kerberos_state);
 848         if (req == NULL) {
 849                 return NULL;
 850         }
 851         state->cli = cli;
 852         state->ads_status = ADS_SUCCESS;
 853
 854         cli_temp_set_signing(cli);
 855
 856         /*
 857          * Ok, this is cheated: spnego_gen_negTokenTarg can block if
 858          * we have to acquire a ticket. To be fixed later :-)
 859          */
 860         rc = spnego_gen_negTokenTarg(principal, 0, &state->negTokenTarg,
 861                                      &state->session_key_krb5, 0, NULL);
 862         if (rc) {
 863                 DEBUG(1, ("cli_session_setup_kerberos: "
 864                           "spnego_gen_negTokenTarg failed: %s\n",
 865                           error_message(rc)));
 866                 state->ads_status = ADS_ERROR_KRB5(rc);
 867                 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
 868                 return tevent_req_post(req, ev);
 869         }
 870
 871 #if 0
 872         file_save("negTokenTarg.dat", state->negTokenTarg.data,
 873                   state->negTokenTarg.length);
 874 #endif
 875
 876         subreq = cli_sesssetup_blob_send(state, ev, cli, state->negTokenTarg);
 877         if (tevent_req_nomem(subreq, req)) {
 878                 return tevent_req_post(req, ev);
 879         }
 880         tevent_req_set_callback(subreq, cli_session_setup_kerberos_done, req);
 881         return req;
 882 }
 883
 884 static void cli_session_setup_kerberos_done(struct tevent_req *subreq)
 885 {
 886         struct tevent_req *req = tevent_req_callback_data(
 887                 subreq, struct tevent_req);
 888         struct cli_session_setup_kerberos_state *state = tevent_req_data(
 889                 req, struct cli_session_setup_kerberos_state);
 890         char *inbuf = NULL;
 891         NTSTATUS status;
 892
 893         status = cli_sesssetup_blob_recv(subreq, talloc_tos(), NULL, &inbuf);
 894         if (!NT_STATUS_IS_OK(status)) {
 895                 TALLOC_FREE(subreq);
 896                 tevent_req_nterror(req, status);
 897                 return;
 898         }
 899
 900         cli_set_session_key(state->cli, state->session_key_krb5);
 901
 902         if (cli_simple_set_signing(state->cli, state->session_key_krb5,
 903                                    data_blob_null)
 904             && !cli_check_sign_mac(state->cli, inbuf, 1)) {
 905                 TALLOC_FREE(subreq);
 906                 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
 907                 return;
 908         }
 909         TALLOC_FREE(subreq);
 910         tevent_req_done(req);
 911 }
 912
 913 static ADS_STATUS cli_session_setup_kerberos_recv(struct tevent_req *req)
 914 {
 915         struct cli_session_setup_kerberos_state *state = tevent_req_data(
 916                 req, struct cli_session_setup_kerberos_state);
 917         NTSTATUS status;
 918
 919         if (tevent_req_is_nterror(req, &status)) {
 920                 return ADS_ERROR_NT(status);
 921         }
 922         return state->ads_status;
 923 }
 924
 925 static ADS_STATUS cli_session_setup_kerberos(struct cli_state *cli,
 926                                              const char *principal,
 927                                              const char *workgroup)
 928 {
 929         struct tevent_context *ev;
 930         struct tevent_req *req;
 931         ADS_STATUS status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
 932
 933         if (cli_has_async_calls(cli)) {
 934                 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
 935         }
 936         ev = tevent_context_init(talloc_tos());
 937         if (ev == NULL) {
 938                 goto fail;
 939         }
 940         req = cli_session_setup_kerberos_send(ev, ev, cli, principal,
 941                                               workgroup);
 942         if (req == NULL) {
 943                 goto fail;
 944         }
 945         if (!tevent_req_poll(req, ev)) {
 946                 status = ADS_ERROR_SYSTEM(errno);
 947                 goto fail;
 948         }
 949         status = cli_session_setup_kerberos_recv(req);
 950 fail:
 951         TALLOC_FREE(ev);
 952         return status;
 953 }
 954 #endif  /* HAVE_KRB5 */
 955
 956 /****************************************************************************
 957  Do a spnego/NTLMSSP encrypted session setup.
 958 ****************************************************************************/
 959
 960 struct cli_session_setup_ntlmssp_state {
 961         struct tevent_context *ev;
 962         struct cli_state *cli;
 963         struct ntlmssp_state *ntlmssp_state;
 964         int turn;
 965         DATA_BLOB blob_out;
 966 };
 967
 968 static int cli_session_setup_ntlmssp_state_destructor(
 969         struct cli_session_setup_ntlmssp_state *state)
 970 {
 971         if (state->ntlmssp_state != NULL) {
 972                 ntlmssp_end(&state->ntlmssp_state);
 973         }
 974         return 0;
 975 }
 976
 977 static void cli_session_setup_ntlmssp_done(struct tevent_req *req);
 978
 979 static struct tevent_req *cli_session_setup_ntlmssp_send(
 980         TALLOC_CTX *mem_ctx, struct tevent_context *ev, struct cli_state *cli,
 981         const char *user, const char *pass, const char *domain)
 982 {
 983         struct tevent_req *req, *subreq;
 984         struct cli_session_setup_ntlmssp_state *state;
 985         NTSTATUS status;
 986         DATA_BLOB blob_out;
 987
 988         req = tevent_req_create(mem_ctx, &state,
 989                                 struct cli_session_setup_ntlmssp_state);
 990         if (req == NULL) {
 991                 return NULL;
 992         }
 993         state->ev = ev;
 994         state->cli = cli;
 995         state->turn = 1;
 996
 997         state->ntlmssp_state = NULL;
 998         talloc_set_destructor(
 999                 state, cli_session_setup_ntlmssp_state_destructor);
1000
1001         cli_temp_set_signing(cli);
1002
1003         status = ntlmssp_client_start(&state->ntlmssp_state);
1004         if (!NT_STATUS_IS_OK(status)) {
1005                 goto fail;
1006         }
1007         ntlmssp_want_feature(state->ntlmssp_state,
1008                              NTLMSSP_FEATURE_SESSION_KEY);
1009         status = ntlmssp_set_username(state->ntlmssp_state, user);
1010         if (!NT_STATUS_IS_OK(status)) {
1011                 goto fail;
1012         }
1013         status = ntlmssp_set_domain(state->ntlmssp_state, domain);
1014         if (!NT_STATUS_IS_OK(status)) {
1015                 goto fail;
1016         }
1017         status = ntlmssp_set_password(state->ntlmssp_state, pass);
1018         if (!NT_STATUS_IS_OK(status)) {
1019                 goto fail;
1020         }
1021         status = ntlmssp_update(state->ntlmssp_state, data_blob_null,
1022                                 &blob_out);
1023         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1024                 goto fail;
1025         }
1026
1027         state->blob_out = gen_negTokenInit(OID_NTLMSSP, blob_out);
1028         data_blob_free(&blob_out);
1029
1030         subreq = cli_sesssetup_blob_send(state, ev, cli, state->blob_out);
1031         if (tevent_req_nomem(subreq, req)) {
1032                 return tevent_req_post(req, ev);
1033         }
1034         tevent_req_set_callback(subreq, cli_session_setup_ntlmssp_done, req);
1035         return req;
1036 fail:
1037         tevent_req_nterror(req, status);
1038         return tevent_req_post(req, ev);
1039 }
1040
1041 static void cli_session_setup_ntlmssp_done(struct tevent_req *subreq)
1042 {
1043         struct tevent_req *req = tevent_req_callback_data(
1044                 subreq, struct tevent_req);
1045         struct cli_session_setup_ntlmssp_state *state = tevent_req_data(
1046                 req, struct cli_session_setup_ntlmssp_state);
1047         DATA_BLOB blob_in, msg_in, blob_out;
1048         char *inbuf = NULL;
1049         bool parse_ret;
1050         NTSTATUS status;
1051
1052         status = cli_sesssetup_blob_recv(subreq, talloc_tos(), &blob_in,
1053                                          &inbuf);
1054         TALLOC_FREE(subreq);
1055         data_blob_free(&state->blob_out);
1056
1057         if (NT_STATUS_IS_OK(status)) {
1058                 if (state->cli->server_domain[0] == '\0') {
1059                         fstrcpy(state->cli->server_domain,
1060                                 state->ntlmssp_state->server_domain);
1061                 }
1062                 cli_set_session_key(
1063                         state->cli, state->ntlmssp_state->session_key);
1064
1065                 if (cli_simple_set_signing(
1066                             state->cli, state->ntlmssp_state->session_key,
1067                             data_blob_null)
1068                     && !cli_check_sign_mac(state->cli, inbuf, 1)) {
1069                         TALLOC_FREE(subreq);
1070                         tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1071                         return;
1072                 }
1073                 TALLOC_FREE(subreq);
1074                 ntlmssp_end(&state->ntlmssp_state);
1075                 tevent_req_done(req);
1076                 return;
1077         }
1078         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1079                 tevent_req_nterror(req, status);
1080                 return;
1081         }
1082
1083         if (blob_in.length == 0) {
1084                 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
1085                 return;
1086         }
1087
1088         if ((state->turn == 1)
1089             && NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1090                 DATA_BLOB tmp_blob = data_blob_null;
1091                 /* the server might give us back two challenges */
1092                 parse_ret = spnego_parse_challenge(blob_in, &msg_in,
1093                                                    &tmp_blob);
1094                 data_blob_free(&tmp_blob);
1095         } else {
1096                 parse_ret = spnego_parse_auth_response(blob_in, status,
1097                                                        OID_NTLMSSP, &msg_in);
1098         }
1099         state->turn += 1;
1100
1101         if (!parse_ret) {
1102                 DEBUG(3,("Failed to parse auth response\n"));
1103                 if (NT_STATUS_IS_OK(status)
1104                     || NT_STATUS_EQUAL(status,
1105                                        NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1106                         tevent_req_nterror(
1107                                 req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1108                         return;
1109                 }
1110         }
1111
1112         status = ntlmssp_update(state->ntlmssp_state, msg_in, &blob_out);
1113
1114         if (!NT_STATUS_IS_OK(status)
1115             && !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1116                 TALLOC_FREE(subreq);
1117                 ntlmssp_end(&state->ntlmssp_state);
1118                 tevent_req_nterror(req, status);
1119                 return;
1120         }
1121
1122         state->blob_out = spnego_gen_auth(blob_out);
1123         TALLOC_FREE(subreq);
1124         if (tevent_req_nomem(state->blob_out.data, req)) {
1125                 return;
1126         }
1127
1128         subreq = cli_sesssetup_blob_send(state, state->ev, state->cli,
1129                                          state->blob_out);
1130         if (tevent_req_nomem(subreq, req)) {
1131                 return;
1132         }
1133         tevent_req_set_callback(subreq, cli_session_setup_ntlmssp_done, req);
1134 }
1135
1136 static NTSTATUS cli_session_setup_ntlmssp_recv(struct tevent_req *req)
1137 {
1138         struct cli_session_setup_ntlmssp_state *state = tevent_req_data(
1139                 req, struct cli_session_setup_ntlmssp_state);
1140         NTSTATUS status;
1141
1142         if (tevent_req_is_nterror(req, &status)) {
1143                 state->cli->vuid = 0;
1144                 return status;
1145         }
1146         return NT_STATUS_OK;
1147 }
1148
1149 static NTSTATUS cli_session_setup_ntlmssp(struct cli_state *cli,
1150                                           const char *user,
1151                                           const char *pass,
1152                                           const char *domain)
1153 {
1154         struct tevent_context *ev;
1155         struct tevent_req *req;
1156         NTSTATUS status = NT_STATUS_NO_MEMORY;
1157
1158         if (cli_has_async_calls(cli)) {
1159                 return NT_STATUS_INVALID_PARAMETER;
1160         }
1161         ev = tevent_context_init(talloc_tos());
1162         if (ev == NULL) {
1163                 goto fail;
1164         }
1165         req = cli_session_setup_ntlmssp_send(ev, ev, cli, user, pass, domain);
1166         if (req == NULL) {
1167                 goto fail;
1168         }
1169         if (!tevent_req_poll_ntstatus(req, ev, &status)) {
1170                 goto fail;
1171         }
1172         status = cli_session_setup_ntlmssp_recv(req);
1173 fail:
1174         TALLOC_FREE(ev);
1175         if (!NT_STATUS_IS_OK(status)) {
1176                 cli_set_error(cli, status);
1177         }
1178         return status;
1179 }
1180
1181 /****************************************************************************
1182  Do a spnego encrypted session setup.
1183
1184  user_domain: The shortname of the domain the user/machine is a member of.
1185  dest_realm: The realm we're connecting to, if NULL we use our default realm.
1186 ****************************************************************************/
1187
1188 ADS_STATUS cli_session_setup_spnego(struct cli_state *cli, const char *user,
1189                               const char *pass, const char *user_domain,
1190                               const char * dest_realm)
1191 {
1192         char *principal = NULL;
1193         char *OIDs[ASN1_MAX_OIDS];
1194         int i;
1195         DATA_BLOB blob;
1196         const char *p = NULL;
1197         char *account = NULL;
1198         NTSTATUS status;
1199
1200         DEBUG(3,("Doing spnego session setup (blob length=%lu)\n", (unsigned long)cli->secblob.length));
1201
1202         /* the server might not even do spnego */
1203         if (cli->secblob.length <= 16) {
1204                 DEBUG(3,("server didn't supply a full spnego negprot\n"));
1205                 goto ntlmssp;
1206         }
1207
1208 #if 0
1209         file_save("negprot.dat", cli->secblob.data, cli->secblob.length);
1210 #endif
1211
1212         /* there is 16 bytes of GUID before the real spnego packet starts */
1213         blob = data_blob(cli->secblob.data+16, cli->secblob.length-16);
1214
1215         /* The server sent us the first part of the SPNEGO exchange in the
1216          * negprot reply. It is WRONG to depend on the principal sent in the
1217          * negprot reply, but right now we do it. If we don't receive one,
1218          * we try to best guess, then fall back to NTLM.  */
1219         if (!spnego_parse_negTokenInit(blob, OIDs, &principal)) {
1220                 data_blob_free(&blob);
1221                 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1222         }
1223         data_blob_free(&blob);
1224
1225         /* make sure the server understands kerberos */
1226         for (i=0;OIDs[i];i++) {
1227                 if (i == 0)
1228                         DEBUG(3,("got OID=%s\n", OIDs[i]));
1229                 else
1230                         DEBUGADD(3,("got OID=%s\n", OIDs[i]));
1231                 if (strcmp(OIDs[i], OID_KERBEROS5_OLD) == 0 ||
1232                     strcmp(OIDs[i], OID_KERBEROS5) == 0) {
1233                         cli->got_kerberos_mechanism = True;
1234                 }
1235                 talloc_free(OIDs[i]);
1236         }
1237
1238         DEBUG(3,("got principal=%s\n", principal ? principal : "<null>"));
1239
1240         status = cli_set_username(cli, user);
1241         if (!NT_STATUS_IS_OK(status)) {
1242                 return ADS_ERROR_NT(status);
1243         }
1244
1245 #ifdef HAVE_KRB5
1246         /* If password is set we reauthenticate to kerberos server
1247          * and do not store results */
1248
1249         if (cli->got_kerberos_mechanism && cli->use_kerberos) {
1250                 ADS_STATUS rc;
1251
1252                 if (pass && *pass) {
1253                         int ret;
1254
1255                         use_in_memory_ccache();
1256                         ret = kerberos_kinit_password(user, pass, 0 /* no time correction for now */, NULL);
1257
1258                         if (ret){
1259                                 TALLOC_FREE(principal);
1260                                 DEBUG(0, ("Kinit failed: %s\n", error_message(ret)));
1261                                 if (cli->fallback_after_kerberos)
1262                                         goto ntlmssp;
1263                                 return ADS_ERROR_KRB5(ret);
1264                         }
1265                 }
1266
1267                 /* If we get a bad principal, try to guess it if
1268                    we have a valid host NetBIOS name.
1269                  */
1270                 if (strequal(principal, ADS_IGNORE_PRINCIPAL)) {
1271                         TALLOC_FREE(principal);
1272                 }
1273
1274                 if (principal == NULL &&
1275                         !is_ipaddress(cli->desthost) &&
1276                         !strequal(STAR_SMBSERVER,
1277                                 cli->desthost)) {
1278                         char *realm = NULL;
1279                         char *machine = NULL;
1280                         char *host = NULL;
1281                         DEBUG(3,("cli_session_setup_spnego: got a "
1282                                 "bad server principal, trying to guess ...\n"));
1283
1284                         host = strchr_m(cli->desthost, '.');
1285                         if (host) {
1286                                 machine = SMB_STRNDUP(cli->desthost,
1287                                         host - cli->desthost);
1288                         } else {
1289                                 machine = SMB_STRDUP(cli->desthost);
1290                         }
1291                         if (machine == NULL) {
1292                                 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1293                         }
1294
1295                         if (dest_realm) {
1296                                 realm = SMB_STRDUP(dest_realm);
1297                                 strupper_m(realm);
1298                         } else {
1299                                 realm = kerberos_get_default_realm_from_ccache();
1300                         }
1301                         if (realm && *realm) {
1302                                 principal = talloc_asprintf(NULL, "%s$@%s",
1303                                                         machine, realm);
1304                                 if (!principal) {
1305                                         SAFE_FREE(machine);
1306                                         SAFE_FREE(realm);
1307                                         return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1308                                 }
1309                                 DEBUG(3,("cli_session_setup_spnego: guessed "
1310                                         "server principal=%s\n",
1311                                         principal ? principal : "<null>"));
1312                         }
1313                         SAFE_FREE(machine);
1314                         SAFE_FREE(realm);
1315                 }
1316
1317                 if (principal) {
1318                         rc = cli_session_setup_kerberos(cli, principal,
1319                                 dest_realm);
1320                         if (ADS_ERR_OK(rc) || !cli->fallback_after_kerberos) {
1321                                 TALLOC_FREE(principal);
1322                                 return rc;
1323                         }
1324                 }
1325         }
1326 #endif
1327
1328         TALLOC_FREE(principal);
1329
1330 ntlmssp:
1331
1332         account = talloc_strdup(talloc_tos(), user);
1333         if (!account) {
1334                 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1335         }
1336
1337         /* when falling back to ntlmssp while authenticating with a machine
1338          * account strip off the realm - gd */
1339
1340         if ((p = strchr_m(user, '@')) != NULL) {
1341                 account[PTR_DIFF(p,user)] = '\0';
1342         }
1343
1344         return ADS_ERROR_NT(cli_session_setup_ntlmssp(cli, account, pass, user_domain));
1345 }
1346
1347 /****************************************************************************
1348  Send a session setup. The username and workgroup is in UNIX character
1349  format and must be converted to DOS codepage format before sending. If the
1350  password is in plaintext, the same should be done.
1351 ****************************************************************************/
1352
1353 NTSTATUS cli_session_setup(struct cli_state *cli,
1354                            const char *user,
1355                            const char *pass, int passlen,
1356                            const char *ntpass, int ntpasslen,
1357                            const char *workgroup)
1358 {
1359         char *p;
1360         fstring user2;
1361
1362         if (user) {
1363                 fstrcpy(user2, user);
1364         } else {
1365                 user2[0] ='\0';
1366         }
1367
1368         if (!workgroup) {
1369                 workgroup = "";
1370         }
1371
1372         /* allow for workgroups as part of the username */
1373         if ((p=strchr_m(user2,'\\')) || (p=strchr_m(user2,'/')) ||
1374             (p=strchr_m(user2,*lp_winbind_separator()))) {
1375                 *p = 0;
1376                 user = p+1;
1377                 workgroup = user2;
1378         }
1379
1380         if (cli->protocol < PROTOCOL_LANMAN1) {
1381                 return NT_STATUS_OK;
1382         }
1383
1384         /* now work out what sort of session setup we are going to
1385            do. I have split this into separate functions to make the
1386            flow a bit easier to understand (tridge) */
1387
1388         /* if its an older server then we have to use the older request format */
1389
1390         if (cli->protocol < PROTOCOL_NT1) {
1391                 if (!lp_client_lanman_auth() && passlen != 24 && (*pass)) {
1392                         DEBUG(1, ("Server requested LM password but 'client lanman auth'"
1393                                   " is disabled\n"));
1394                         return NT_STATUS_ACCESS_DENIED;
1395                 }
1396
1397                 if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0 &&
1398                     !lp_client_plaintext_auth() && (*pass)) {
1399                         DEBUG(1, ("Server requested plaintext password but "
1400                                   "'client plaintext auth' is disabled\n"));
1401                         return NT_STATUS_ACCESS_DENIED;
1402                 }
1403
1404                 return cli_session_setup_lanman2(cli, user, pass, passlen,
1405                                                  workgroup);
1406         }
1407
1408         /* if no user is supplied then we have to do an anonymous connection.
1409            passwords are ignored */
1410
1411         if (!user || !*user)
1412                 return cli_session_setup_guest(cli);
1413
1414         /* if the server is share level then send a plaintext null
1415            password at this point. The password is sent in the tree
1416            connect */
1417
1418         if ((cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) == 0)
1419                 return cli_session_setup_plaintext(cli, user, "", workgroup);
1420
1421         /* if the server doesn't support encryption then we have to use
1422            plaintext. The second password is ignored */
1423
1424         if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0) {
1425                 if (!lp_client_plaintext_auth() && (*pass)) {
1426                         DEBUG(1, ("Server requested plaintext password but "
1427                                   "'client plaintext auth' is disabled\n"));
1428                         return NT_STATUS_ACCESS_DENIED;
1429                 }
1430                 return cli_session_setup_plaintext(cli, user, pass, workgroup);
1431         }
1432
1433         /* if the server supports extended security then use SPNEGO */
1434
1435         if (cli->capabilities & CAP_EXTENDED_SECURITY) {
1436                 ADS_STATUS status = cli_session_setup_spnego(cli, user, pass,
1437                                                              workgroup, NULL);
1438                 if (!ADS_ERR_OK(status)) {
1439                         DEBUG(3, ("SPNEGO login failed: %s\n", ads_errstr(status)));
1440                         return ads_ntstatus(status);
1441                 }
1442         } else {
1443                 NTSTATUS status;
1444
1445                 /* otherwise do a NT1 style session setup */
1446                 status = cli_session_setup_nt1(cli, user, pass, passlen,
1447                                                ntpass, ntpasslen, workgroup);
1448                 if (!NT_STATUS_IS_OK(status)) {
1449                         DEBUG(3,("cli_session_setup: NT1 session setup "
1450                                  "failed: %s\n", nt_errstr(status)));
1451                         return status;
1452                 }
1453         }
1454
1455         if (strstr(cli->server_type, "Samba")) {
1456                 cli->is_samba = True;
1457         }
1458
1459         return NT_STATUS_OK;
1460 }
1461
1462 /****************************************************************************
1463  Send a uloggoff.
1464 *****************************************************************************/
1465
1466 struct cli_ulogoff_state {
1467         struct cli_state *cli;
1468         uint16_t vwv[2];
1469 };
1470
1471 static void cli_ulogoff_done(struct tevent_req *subreq);
1472
1473 struct tevent_req *cli_ulogoff_send(TALLOC_CTX *mem_ctx,
1474                                     struct tevent_context *ev,
1475                                     struct cli_state *cli)
1476 {
1477         struct tevent_req *req, *subreq;
1478         struct cli_ulogoff_state *state;
1479
1480         req = tevent_req_create(mem_ctx, &state, struct cli_ulogoff_state);
1481         if (req == NULL) {
1482                 return NULL;
1483         }
1484         state->cli = cli;
1485
1486         SCVAL(state->vwv+0, 0, 0xFF);
1487         SCVAL(state->vwv+1, 0, 0);
1488         SSVAL(state->vwv+2, 0, 0);
1489
1490         subreq = cli_smb_send(state, ev, cli, SMBulogoffX, 0, 2, state->vwv,
1491                               0, NULL);
1492         if (tevent_req_nomem(subreq, req)) {
1493                 return tevent_req_post(req, ev);
1494         }
1495         tevent_req_set_callback(subreq, cli_ulogoff_done, req);
1496         return req;
1497 }
1498
1499 static void cli_ulogoff_done(struct tevent_req *subreq)
1500 {
1501         struct tevent_req *req = tevent_req_callback_data(
1502                 subreq, struct tevent_req);
1503         struct cli_ulogoff_state *state = tevent_req_data(
1504                 req, struct cli_ulogoff_state);
1505         NTSTATUS status;
1506
1507         status = cli_smb_recv(subreq, 0, NULL, NULL, NULL, NULL);
1508         if (!NT_STATUS_IS_OK(status)) {
1509                 tevent_req_nterror(req, status);
1510                 return;
1511         }
1512         state->cli->vuid = -1;
1513         tevent_req_done(req);
1514 }
1515
1516 NTSTATUS cli_ulogoff_recv(struct tevent_req *req)
1517 {
1518         return tevent_req_simple_recv_ntstatus(req);
1519 }
1520
1521 NTSTATUS cli_ulogoff(struct cli_state *cli)
1522 {
1523         struct tevent_context *ev;
1524         struct tevent_req *req;
1525         NTSTATUS status = NT_STATUS_NO_MEMORY;
1526
1527         if (cli_has_async_calls(cli)) {
1528                 return NT_STATUS_INVALID_PARAMETER;
1529         }
1530         ev = tevent_context_init(talloc_tos());
1531         if (ev == NULL) {
1532                 goto fail;
1533         }
1534         req = cli_ulogoff_send(ev, ev, cli);
1535         if (req == NULL) {
1536                 goto fail;
1537         }
1538         if (!tevent_req_poll_ntstatus(req, ev, &status)) {
1539                 goto fail;
1540         }
1541         status = cli_ulogoff_recv(req);
1542 fail:
1543         TALLOC_FREE(ev);
1544         if (!NT_STATUS_IS_OK(status)) {
1545                 cli_set_error(cli, status);
1546         }
1547         return status;
1548 }
1549
1550 /****************************************************************************
1551  Send a tconX.
1552 ****************************************************************************/
1553
1554 struct cli_tcon_andx_state {
1555         struct cli_state *cli;
1556         uint16_t vwv[4];
1557         struct iovec bytes;
1558 };
1559
1560 static void cli_tcon_andx_done(struct tevent_req *subreq);
1561
1562 struct tevent_req *cli_tcon_andx_create(TALLOC_CTX *mem_ctx,
1563                                         struct event_context *ev,
1564                                         struct cli_state *cli,
1565                                         const char *share, const char *dev,
1566                                         const char *pass, int passlen,
1567                                         struct tevent_req **psmbreq)
1568 {
1569         struct tevent_req *req, *subreq;
1570         struct cli_tcon_andx_state *state;
1571         fstring pword;
1572         uint16_t *vwv;
1573         char *tmp = NULL;
1574         uint8_t *bytes;
1575
1576         *psmbreq = NULL;
1577
1578         req = tevent_req_create(mem_ctx, &state, struct cli_tcon_andx_state);
1579         if (req == NULL) {
1580                 return NULL;
1581         }
1582         state->cli = cli;
1583         vwv = state->vwv;
1584
1585         fstrcpy(cli->share, share);
1586
1587         /* in user level security don't send a password now */
1588         if (cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) {
1589                 passlen = 1;
1590                 pass = "";
1591         } else if (pass == NULL) {
1592                 DEBUG(1, ("Server not using user level security and no "
1593                           "password supplied.\n"));
1594                 goto access_denied;
1595         }
1596
1597         if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) &&
1598             *pass && passlen != 24) {
1599                 if (!lp_client_lanman_auth()) {
1600                         DEBUG(1, ("Server requested LANMAN password "
1601                                   "(share-level security) but "
1602                                   "'client lanman auth' is disabled\n"));
1603                         goto access_denied;
1604                 }
1605
1606                 /*
1607                  * Non-encrypted passwords - convert to DOS codepage before
1608                  * encryption.
1609                  */
1610                 passlen = 24;
1611                 SMBencrypt(pass, cli->secblob.data, (uchar *)pword);
1612         } else {
1613                 if((cli->sec_mode & (NEGOTIATE_SECURITY_USER_LEVEL
1614                                      |NEGOTIATE_SECURITY_CHALLENGE_RESPONSE))
1615                    == 0) {
1616                         if (!lp_client_plaintext_auth() && (*pass)) {
1617                                 DEBUG(1, ("Server requested plaintext "
1618                                           "password but 'client plaintext "
1619                                           "auth' is disabled\n"));
1620                                 goto access_denied;
1621                         }
1622
1623                         /*
1624                          * Non-encrypted passwords - convert to DOS codepage
1625                          * before using.
1626                          */
1627                         passlen = clistr_push(cli, pword, pass, sizeof(pword),
1628                                               STR_TERMINATE);
1629                         if (passlen == -1) {
1630                                 DEBUG(1, ("clistr_push(pword) failed\n"));
1631                                 goto access_denied;
1632                         }
1633                 } else {
1634                         if (passlen) {
1635                                 memcpy(pword, pass, passlen);
1636                         }
1637                 }
1638         }
1639
1640         SCVAL(vwv+0, 0, 0xFF);
1641         SCVAL(vwv+0, 1, 0);
1642         SSVAL(vwv+1, 0, 0);
1643         SSVAL(vwv+2, 0, TCONX_FLAG_EXTENDED_RESPONSE);
1644         SSVAL(vwv+3, 0, passlen);
1645
1646         if (passlen) {
1647                 bytes = (uint8_t *)talloc_memdup(state, pword, passlen);
1648         } else {
1649                 bytes = talloc_array(state, uint8_t, 0);
1650         }
1651
1652         /*
1653          * Add the sharename
1654          */
1655         tmp = talloc_asprintf_strupper_m(talloc_tos(), "\\\\%s\\%s",
1656                                          cli->desthost, share);
1657         if (tmp == NULL) {
1658                 TALLOC_FREE(req);
1659                 return NULL;
1660         }
1661         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), tmp, strlen(tmp)+1,
1662                                    NULL);
1663         TALLOC_FREE(tmp);
1664
1665         /*
1666          * Add the devicetype
1667          */
1668         tmp = talloc_strdup_upper(talloc_tos(), dev);
1669         if (tmp == NULL) {
1670                 TALLOC_FREE(req);
1671                 return NULL;
1672         }
1673         bytes = smb_bytes_push_str(bytes, false, tmp, strlen(tmp)+1, NULL);
1674         TALLOC_FREE(tmp);
1675
1676         if (bytes == NULL) {
1677                 TALLOC_FREE(req);
1678                 return NULL;
1679         }
1680
1681         state->bytes.iov_base = (void *)bytes;
1682         state->bytes.iov_len = talloc_get_size(bytes);
1683
1684         subreq = cli_smb_req_create(state, ev, cli, SMBtconX, 0, 4, vwv,
1685                                     1, &state->bytes);
1686         if (subreq == NULL) {
1687                 TALLOC_FREE(req);
1688                 return NULL;
1689         }
1690         tevent_req_set_callback(subreq, cli_tcon_andx_done, req);
1691         *psmbreq = subreq;
1692         return req;
1693
1694  access_denied:
1695         tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1696         return tevent_req_post(req, ev);
1697 }
1698
1699 struct tevent_req *cli_tcon_andx_send(TALLOC_CTX *mem_ctx,
1700                                       struct event_context *ev,
1701                                       struct cli_state *cli,
1702                                       const char *share, const char *dev,
1703                                       const char *pass, int passlen)
1704 {
1705         struct tevent_req *req, *subreq;
1706         NTSTATUS status;
1707
1708         req = cli_tcon_andx_create(mem_ctx, ev, cli, share, dev, pass, passlen,
1709                                    &subreq);
1710         if (req == NULL) {
1711                 return NULL;
1712         }
1713         if (subreq == NULL) {
1714                 return req;
1715         }
1716         status = cli_smb_req_send(subreq);
1717         if (!NT_STATUS_IS_OK(status)) {
1718                 tevent_req_nterror(req, status);
1719                 return tevent_req_post(req, ev);
1720         }
1721         return req;
1722 }
1723
1724 static void cli_tcon_andx_done(struct tevent_req *subreq)
1725 {
1726         struct tevent_req *req = tevent_req_callback_data(
1727                 subreq, struct tevent_req);
1728         struct cli_tcon_andx_state *state = tevent_req_data(
1729                 req, struct cli_tcon_andx_state);
1730         struct cli_state *cli = state->cli;
1731         char *inbuf = (char *)cli_smb_inbuf(subreq);
1732         uint8_t wct;
1733         uint16_t *vwv;
1734         uint32_t num_bytes;
1735         uint8_t *bytes;
1736         NTSTATUS status;
1737
1738         status = cli_smb_recv(subreq, 0, &wct, &vwv, &num_bytes, &bytes);
1739         if (!NT_STATUS_IS_OK(status)) {
1740                 TALLOC_FREE(subreq);
1741                 tevent_req_nterror(req, status);
1742                 return;
1743         }
1744
1745         clistr_pull(inbuf, cli->dev, bytes, sizeof(fstring), num_bytes,
1746                     STR_TERMINATE|STR_ASCII);
1747
1748         if ((cli->protocol >= PROTOCOL_NT1) && (num_bytes == 3)) {
1749                 /* almost certainly win95 - enable bug fixes */
1750                 cli->win95 = True;
1751         }
1752
1753         /*
1754          * Make sure that we have the optional support 16-bit field. WCT > 2.
1755          * Avoids issues when connecting to Win9x boxes sharing files
1756          */
1757
1758         cli->dfsroot = false;
1759
1760         if ((wct > 2) && (cli->protocol >= PROTOCOL_LANMAN2)) {
1761                 cli->dfsroot = ((SVAL(vwv+2, 0) & SMB_SHARE_IN_DFS) != 0);
1762         }
1763
1764         cli->cnum = SVAL(inbuf,smb_tid);
1765         tevent_req_done(req);
1766 }
1767
1768 NTSTATUS cli_tcon_andx_recv(struct tevent_req *req)
1769 {
1770         return tevent_req_simple_recv_ntstatus(req);
1771 }
1772
1773 NTSTATUS cli_tcon_andx(struct cli_state *cli, const char *share,
1774                        const char *dev, const char *pass, int passlen)
1775 {
1776         TALLOC_CTX *frame = talloc_stackframe();
1777         struct event_context *ev;
1778         struct tevent_req *req;
1779         NTSTATUS status = NT_STATUS_OK;
1780
1781         if (cli_has_async_calls(cli)) {
1782                 /*
1783                  * Can't use sync call while an async call is in flight
1784                  */
1785                 status = NT_STATUS_INVALID_PARAMETER;
1786                 goto fail;
1787         }
1788
1789         ev = event_context_init(frame);
1790         if (ev == NULL) {
1791                 status = NT_STATUS_NO_MEMORY;
1792                 goto fail;
1793         }
1794
1795         req = cli_tcon_andx_send(frame, ev, cli, share, dev, pass, passlen);
1796         if (req == NULL) {
1797                 status = NT_STATUS_NO_MEMORY;
1798                 goto fail;
1799         }
1800
1801         if (!tevent_req_poll(req, ev)) {
1802                 status = map_nt_error_from_unix(errno);
1803                 goto fail;
1804         }
1805
1806         status = cli_tcon_andx_recv(req);
1807  fail:
1808         TALLOC_FREE(frame);
1809         if (!NT_STATUS_IS_OK(status)) {
1810                 cli_set_error(cli, status);
1811         }
1812         return status;
1813 }
1814
1815 /****************************************************************************
1816  Send a tree disconnect.
1817 ****************************************************************************/
1818
1819 struct cli_tdis_state {
1820         struct cli_state *cli;
1821 };
1822
1823 static void cli_tdis_done(struct tevent_req *subreq);
1824
1825 struct tevent_req *cli_tdis_send(TALLOC_CTX *mem_ctx,
1826                                  struct tevent_context *ev,
1827                                  struct cli_state *cli)
1828 {
1829         struct tevent_req *req, *subreq;
1830         struct cli_tdis_state *state;
1831
1832         req = tevent_req_create(mem_ctx, &state, struct cli_tdis_state);
1833         if (req == NULL) {
1834                 return NULL;
1835         }
1836         state->cli = cli;
1837
1838         subreq = cli_smb_send(state, ev, cli, SMBtdis, 0, 0, NULL, 0, NULL);
1839         if (tevent_req_nomem(subreq, req)) {
1840                 return tevent_req_post(req, ev);
1841         }
1842         tevent_req_set_callback(subreq, cli_tdis_done, req);
1843         return req;
1844 }
1845
1846 static void cli_tdis_done(struct tevent_req *subreq)
1847 {
1848         struct tevent_req *req = tevent_req_callback_data(
1849                 subreq, struct tevent_req);
1850         struct cli_tdis_state *state = tevent_req_data(
1851                 req, struct cli_tdis_state);
1852         NTSTATUS status;
1853
1854         status = cli_smb_recv(subreq, 0, NULL, NULL, NULL, NULL);
1855         TALLOC_FREE(subreq);
1856         if (!NT_STATUS_IS_OK(status)) {
1857                 tevent_req_nterror(req, status);
1858                 return;
1859         }
1860         state->cli->cnum = -1;
1861         tevent_req_done(req);
1862 }
1863
1864 NTSTATUS cli_tdis_recv(struct tevent_req *req)
1865 {
1866         return tevent_req_simple_recv_ntstatus(req);
1867 }
1868
1869 NTSTATUS cli_tdis(struct cli_state *cli)
1870 {
1871         struct tevent_context *ev;
1872         struct tevent_req *req;
1873         NTSTATUS status = NT_STATUS_NO_MEMORY;
1874
1875         if (cli_has_async_calls(cli)) {
1876                 return NT_STATUS_INVALID_PARAMETER;
1877         }
1878         ev = tevent_context_init(talloc_tos());
1879         if (ev == NULL) {
1880                 goto fail;
1881         }
1882         req = cli_tdis_send(ev, ev, cli);
1883         if (req == NULL) {
1884                 goto fail;
1885         }
1886         if (!tevent_req_poll_ntstatus(req, ev, &status)) {
1887                 goto fail;
1888         }
1889         status = cli_tdis_recv(req);
1890 fail:
1891         TALLOC_FREE(ev);
1892         if (!NT_STATUS_IS_OK(status)) {
1893                 cli_set_error(cli, status);
1894         }
1895         return status;
1896 }
1897
1898 /****************************************************************************
1899  Send a negprot command.
1900 ****************************************************************************/
1901
1902 void cli_negprot_sendsync(struct cli_state *cli)
1903 {
1904         char *p;
1905         int numprots;
1906
1907         if (cli->protocol < PROTOCOL_NT1)
1908                 cli->use_spnego = False;
1909
1910         memset(cli->outbuf,'\0',smb_size);
1911
1912         /* setup the protocol strings */
1913         cli_set_message(cli->outbuf,0,0,True);
1914
1915         p = smb_buf(cli->outbuf);
1916         for (numprots=0; numprots < ARRAY_SIZE(prots); numprots++) {
1917                 if (prots[numprots].prot > cli->protocol) {
1918                         break;
1919                 }
1920                 *p++ = 2;
1921                 p += clistr_push(cli, p, prots[numprots].name, -1, STR_TERMINATE);
1922         }
1923
1924         SCVAL(cli->outbuf,smb_com,SMBnegprot);
1925         cli_setup_bcc(cli, p);
1926         cli_setup_packet(cli);
1927
1928         SCVAL(smb_buf(cli->outbuf),0,2);
1929
1930         cli_send_smb(cli);
1931 }
1932
1933 /****************************************************************************
1934  Send a negprot command.
1935 ****************************************************************************/
1936
1937 struct cli_negprot_state {
1938         struct cli_state *cli;
1939 };
1940
1941 static void cli_negprot_done(struct tevent_req *subreq);
1942
1943 struct tevent_req *cli_negprot_send(TALLOC_CTX *mem_ctx,
1944                                     struct event_context *ev,
1945                                     struct cli_state *cli)
1946 {
1947         struct tevent_req *req, *subreq;
1948         struct cli_negprot_state *state;
1949         uint8_t *bytes = NULL;
1950         int numprots;
1951         uint16_t cnum;
1952
1953         req = tevent_req_create(mem_ctx, &state, struct cli_negprot_state);
1954         if (req == NULL) {
1955                 return NULL;
1956         }
1957         state->cli = cli;
1958
1959         if (cli->protocol < PROTOCOL_NT1)
1960                 cli->use_spnego = False;
1961
1962         /* setup the protocol strings */
1963         for (numprots=0; numprots < ARRAY_SIZE(prots); numprots++) {
1964                 uint8_t c = 2;
1965                 if (prots[numprots].prot > cli->protocol) {
1966                         break;
1967                 }
1968                 bytes = (uint8_t *)talloc_append_blob(
1969                         state, bytes, data_blob_const(&c, sizeof(c)));
1970                 if (tevent_req_nomem(bytes, req)) {
1971                         return tevent_req_post(req, ev);
1972                 }
1973                 bytes = smb_bytes_push_str(bytes, false,
1974                                            prots[numprots].name,
1975                                            strlen(prots[numprots].name)+1,
1976                                            NULL);
1977                 if (tevent_req_nomem(bytes, req)) {
1978                         return tevent_req_post(req, ev);
1979                 }
1980         }
1981
1982         cnum = cli->cnum;
1983
1984         cli->cnum = 0;
1985         subreq = cli_smb_send(state, ev, cli, SMBnegprot, 0, 0, NULL,
1986                               talloc_get_size(bytes), bytes);
1987         cli->cnum = cnum;
1988
1989         if (tevent_req_nomem(subreq, req)) {
1990                 return tevent_req_post(req, ev);
1991         }
1992         tevent_req_set_callback(subreq, cli_negprot_done, req);
1993         return req;
1994 }
1995
1996 static void cli_negprot_done(struct tevent_req *subreq)
1997 {
1998         struct tevent_req *req = tevent_req_callback_data(
1999                 subreq, struct tevent_req);
2000         struct cli_negprot_state *state = tevent_req_data(
2001                 req, struct cli_negprot_state);
2002         struct cli_state *cli = state->cli;
2003         uint8_t wct;
2004         uint16_t *vwv;
2005         uint32_t num_bytes;
2006         uint8_t *bytes;
2007         NTSTATUS status;
2008         uint16_t protnum;
2009
2010         status = cli_smb_recv(subreq, 1, &wct, &vwv, &num_bytes, &bytes);
2011         if (!NT_STATUS_IS_OK(status)) {
2012                 TALLOC_FREE(subreq);
2013                 tevent_req_nterror(req, status);
2014                 return;
2015         }
2016
2017         protnum = SVAL(vwv, 0);
2018
2019         if ((protnum >= ARRAY_SIZE(prots))
2020             || (prots[protnum].prot > cli->protocol)) {
2021                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
2022                 return;
2023         }
2024
2025         cli->protocol = prots[protnum].prot;
2026
2027         if ((cli->protocol < PROTOCOL_NT1) &&
2028             client_is_signing_mandatory(cli)) {
2029                 DEBUG(0,("cli_negprot: SMB signing is mandatory and the selected protocol level doesn't support it.\n"));
2030                 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
2031                 return;
2032         }
2033
2034         if (cli->protocol >= PROTOCOL_NT1) {
2035                 struct timespec ts;
2036                 bool negotiated_smb_signing = false;
2037
2038                 /* NT protocol */
2039                 cli->sec_mode = CVAL(vwv + 1, 0);
2040                 cli->max_mux = SVAL(vwv + 1, 1);
2041                 cli->max_xmit = IVAL(vwv + 3, 1);
2042                 cli->sesskey = IVAL(vwv + 7, 1);
2043                 cli->serverzone = SVALS(vwv + 15, 1);
2044                 cli->serverzone *= 60;
2045                 /* this time arrives in real GMT */
2046                 ts = interpret_long_date(((char *)(vwv+11))+1);
2047                 cli->servertime = ts.tv_sec;
2048                 cli->secblob = data_blob(bytes, num_bytes);
2049                 cli->capabilities = IVAL(vwv + 9, 1);
2050                 if (cli->capabilities & CAP_RAW_MODE) {
2051                         cli->readbraw_supported = True;
2052                         cli->writebraw_supported = True;
2053                 }
2054                 /* work out if they sent us a workgroup */
2055                 if (!(cli->capabilities & CAP_EXTENDED_SECURITY) &&
2056                     smb_buflen(cli->inbuf) > 8) {
2057                         clistr_pull(cli->inbuf, cli->server_domain,
2058                                     bytes+8, sizeof(cli->server_domain),
2059                                     num_bytes-8,
2060                                     STR_UNICODE|STR_NOALIGN);
2061                 }
2062
2063                 /*
2064                  * As signing is slow we only turn it on if either the client or
2065                  * the server require it. JRA.
2066                  */
2067
2068                 if (cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED) {
2069                         /* Fail if server says signing is mandatory and we don't want to support it. */
2070                         if (!client_is_signing_allowed(cli)) {
2071                                 DEBUG(0,("cli_negprot: SMB signing is mandatory and we have disabled it.\n"));
2072                                 tevent_req_nterror(req,
2073                                                    NT_STATUS_ACCESS_DENIED);
2074                                 return;
2075                         }
2076                         negotiated_smb_signing = true;
2077                 } else if (client_is_signing_mandatory(cli) && client_is_signing_allowed(cli)) {
2078                         /* Fail if client says signing is mandatory and the server doesn't support it. */
2079                         if (!(cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED)) {
2080                                 DEBUG(1,("cli_negprot: SMB signing is mandatory and the server doesn't support it.\n"));
2081                                 tevent_req_nterror(req,
2082                                                    NT_STATUS_ACCESS_DENIED);
2083                                 return;
2084                         }
2085                         negotiated_smb_signing = true;
2086                 } else if (cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED) {
2087                         negotiated_smb_signing = true;
2088                 }
2089
2090                 if (negotiated_smb_signing) {
2091                         cli_set_signing_negotiated(cli);
2092                 }
2093
2094                 if (cli->capabilities & (CAP_LARGE_READX|CAP_LARGE_WRITEX)) {
2095                         SAFE_FREE(cli->outbuf);
2096                         SAFE_FREE(cli->inbuf);
2097                         cli->outbuf = (char *)SMB_MALLOC(CLI_SAMBA_MAX_LARGE_READX_SIZE+LARGE_WRITEX_HDR_SIZE+SAFETY_MARGIN);
2098                         cli->inbuf = (char *)SMB_MALLOC(CLI_SAMBA_MAX_LARGE_READX_SIZE+LARGE_WRITEX_HDR_SIZE+SAFETY_MARGIN);
2099                         cli->bufsize = CLI_SAMBA_MAX_LARGE_READX_SIZE + LARGE_WRITEX_HDR_SIZE;
2100                 }
2101
2102         } else if (cli->protocol >= PROTOCOL_LANMAN1) {
2103                 cli->use_spnego = False;
2104                 cli->sec_mode = SVAL(vwv + 1, 0);
2105                 cli->max_xmit = SVAL(vwv + 2, 0);
2106                 cli->max_mux = SVAL(vwv + 3, 0);
2107                 cli->sesskey = IVAL(vwv + 6, 0);
2108                 cli->serverzone = SVALS(vwv + 10, 0);
2109                 cli->serverzone *= 60;
2110                 /* this time is converted to GMT by make_unix_date */
2111                 cli->servertime = cli_make_unix_date(
2112                         cli, (char *)(vwv + 8));
2113                 cli->readbraw_supported = ((SVAL(vwv + 5, 0) & 0x1) != 0);
2114                 cli->writebraw_supported = ((SVAL(vwv + 5, 0) & 0x2) != 0);
2115                 cli->secblob = data_blob(bytes, num_bytes);
2116         } else {
2117                 /* the old core protocol */
2118                 cli->use_spnego = False;
2119                 cli->sec_mode = 0;
2120                 cli->serverzone = get_time_zone(time(NULL));
2121         }
2122
2123         cli->max_xmit = MIN(cli->max_xmit, CLI_BUFFER_SIZE);
2124
2125         /* a way to force ascii SMB */
2126         if (getenv("CLI_FORCE_ASCII"))
2127                 cli->capabilities &= ~CAP_UNICODE;
2128
2129         tevent_req_done(req);
2130 }
2131
2132 NTSTATUS cli_negprot_recv(struct tevent_req *req)
2133 {
2134         return tevent_req_simple_recv_ntstatus(req);
2135 }
2136
2137 NTSTATUS cli_negprot(struct cli_state *cli)
2138 {
2139         TALLOC_CTX *frame = talloc_stackframe();
2140         struct event_context *ev;
2141         struct tevent_req *req;
2142         NTSTATUS status = NT_STATUS_OK;
2143
2144         if (cli_has_async_calls(cli)) {
2145                 /*
2146                  * Can't use sync call while an async call is in flight
2147                  */
2148                 status = NT_STATUS_INVALID_PARAMETER;
2149                 goto fail;
2150         }
2151
2152         ev = event_context_init(frame);
2153         if (ev == NULL) {
2154                 status = NT_STATUS_NO_MEMORY;
2155                 goto fail;
2156         }
2157
2158         req = cli_negprot_send(frame, ev, cli);
2159         if (req == NULL) {
2160                 status = NT_STATUS_NO_MEMORY;
2161                 goto fail;
2162         }
2163
2164         if (!tevent_req_poll(req, ev)) {
2165                 status = map_nt_error_from_unix(errno);
2166                 goto fail;
2167         }
2168
2169         status = cli_negprot_recv(req);
2170  fail:
2171         TALLOC_FREE(frame);
2172         if (!NT_STATUS_IS_OK(status)) {
2173                 cli_set_error(cli, status);
2174         }
2175         return status;
2176 }
2177
2178 /****************************************************************************
2179  Send a session request. See rfc1002.txt 4.3 and 4.3.2.
2180 ****************************************************************************/
2181
2182 bool cli_session_request(struct cli_state *cli,
2183                          struct nmb_name *calling, struct nmb_name *called)
2184 {
2185         char *p;
2186         int len = 4;
2187         char *tmp;
2188
2189         /* 445 doesn't have session request */
2190         if (cli->port == 445)
2191                 return True;
2192
2193         memcpy(&(cli->calling), calling, sizeof(*calling));
2194         memcpy(&(cli->called ), called , sizeof(*called ));
2195
2196         /* put in the destination name */
2197
2198         tmp = name_mangle(talloc_tos(), cli->called.name,
2199                           cli->called.name_type);
2200         if (tmp == NULL) {
2201                 return false;
2202         }
2203
2204         p = cli->outbuf+len;
2205         memcpy(p, tmp, name_len(tmp));
2206         len += name_len(tmp);
2207         TALLOC_FREE(tmp);
2208
2209         /* and my name */
2210
2211         tmp = name_mangle(talloc_tos(), cli->calling.name,
2212                           cli->calling.name_type);
2213         if (tmp == NULL) {
2214                 return false;
2215         }
2216
2217         p = cli->outbuf+len;
2218         memcpy(p, tmp, name_len(tmp));
2219         len += name_len(tmp);
2220         TALLOC_FREE(tmp);
2221
2222         /* send a session request (RFC 1002) */
2223         /* setup the packet length
2224          * Remove four bytes from the length count, since the length
2225          * field in the NBT Session Service header counts the number
2226          * of bytes which follow.  The cli_send_smb() function knows
2227          * about this and accounts for those four bytes.
2228          * CRH.
2229          */
2230         len -= 4;
2231         _smb_setlen(cli->outbuf,len);
2232         SCVAL(cli->outbuf,0,0x81);
2233
2234         cli_send_smb(cli);
2235         DEBUG(5,("Sent session request\n"));
2236
2237         if (!cli_receive_smb(cli))
2238                 return False;
2239
2240         if (CVAL(cli->inbuf,0) == 0x84) {
2241                 /* C. Hoch  9/14/95 Start */
2242                 /* For information, here is the response structure.
2243                  * We do the byte-twiddling to for portability.
2244                 struct RetargetResponse{
2245                 unsigned char type;
2246                 unsigned char flags;
2247                 int16 length;
2248                 int32 ip_addr;
2249                 int16 port;
2250                 };
2251                 */
2252                 uint16_t port = (CVAL(cli->inbuf,8)<<8)+CVAL(cli->inbuf,9);
2253                 struct in_addr dest_ip;
2254                 NTSTATUS status;
2255
2256                 /* SESSION RETARGET */
2257                 putip((char *)&dest_ip,cli->inbuf+4);
2258                 in_addr_to_sockaddr_storage(&cli->dest_ss, dest_ip);
2259
2260                 status = open_socket_out(&cli->dest_ss, port,
2261                                          LONG_CONNECT_TIMEOUT, &cli->fd);
2262                 if (!NT_STATUS_IS_OK(status)) {
2263                         return False;
2264                 }
2265
2266                 DEBUG(3,("Retargeted\n"));
2267
2268                 set_socket_options(cli->fd, lp_socket_options());
2269
2270                 /* Try again */
2271                 {
2272                         static int depth;
2273                         bool ret;
2274                         if (depth > 4) {
2275                                 DEBUG(0,("Retarget recursion - failing\n"));
2276                                 return False;
2277                         }
2278                         depth++;
2279                         ret = cli_session_request(cli, calling, called);
2280                         depth--;
2281                         return ret;
2282                 }
2283         } /* C. Hoch 9/14/95 End */
2284
2285         if (CVAL(cli->inbuf,0) != 0x82) {
2286                 /* This is the wrong place to put the error... JRA. */
2287                 cli->rap_error = CVAL(cli->inbuf,4);
2288                 return False;
2289         }
2290         return(True);
2291 }
2292
2293 struct fd_struct {
2294         int fd;
2295 };
2296
2297 static void smb_sock_connected(struct tevent_req *req)
2298 {
2299         struct fd_struct *pfd = tevent_req_callback_data(
2300                 req, struct fd_struct);
2301         int fd;
2302         NTSTATUS status;
2303
2304         status = open_socket_out_defer_recv(req, &fd);
2305         if (NT_STATUS_IS_OK(status)) {
2306                 pfd->fd = fd;
2307         }
2308 }
2309
2310 static NTSTATUS open_smb_socket(const struct sockaddr_storage *pss,
2311                                 uint16_t *port, int timeout, int *pfd)
2312 {
2313         struct event_context *ev;
2314         struct tevent_req *r139, *r445;
2315         struct fd_struct *fd139, *fd445;
2316         NTSTATUS status = NT_STATUS_NO_MEMORY;
2317
2318         if (*port != 0) {
2319                 return open_socket_out(pss, *port, timeout, pfd);
2320         }
2321
2322         ev = event_context_init(talloc_tos());
2323         if (ev == NULL) {
2324                 return NT_STATUS_NO_MEMORY;
2325         }
2326
2327         fd139 = talloc(ev, struct fd_struct);
2328         if (fd139 == NULL) {
2329                 goto done;
2330         }
2331         fd139->fd = -1;
2332
2333         fd445 = talloc(ev, struct fd_struct);
2334         if (fd445 == NULL) {
2335                 goto done;
2336         }
2337         fd445->fd = -1;
2338
2339         r445 = open_socket_out_defer_send(ev, ev, timeval_set(0, 0),
2340                                           pss, 445, timeout);
2341         r139 = open_socket_out_defer_send(ev, ev, timeval_set(0, 3000),
2342                                           pss, 139, timeout);
2343         if ((r445 == NULL) || (r139 == NULL)) {
2344                 goto done;
2345         }
2346         tevent_req_set_callback(r445, smb_sock_connected, fd445);
2347         tevent_req_set_callback(r139, smb_sock_connected, fd139);
2348
2349         while ((fd445->fd == -1) && (fd139->fd == -1)
2350                && (tevent_req_is_in_progress(r139)
2351                    || tevent_req_is_in_progress(r445))) {
2352                 event_loop_once(ev);
2353         }
2354
2355         if ((fd139->fd != -1) && (fd445->fd != -1)) {
2356                 close(fd139->fd);
2357                 fd139->fd = -1;
2358         }
2359
2360         if (fd445->fd != -1) {
2361                 *port = 445;
2362                 *pfd = fd445->fd;
2363                 status = NT_STATUS_OK;
2364                 goto done;
2365         }
2366         if (fd139->fd != -1) {
2367                 *port = 139;
2368                 *pfd = fd139->fd;
2369                 status = NT_STATUS_OK;
2370                 goto done;
2371         }
2372
2373         status = open_socket_out_defer_recv(r445, &fd445->fd);
2374  done:
2375         TALLOC_FREE(ev);
2376         return status;
2377 }
2378
2379 /****************************************************************************
2380  Open the client sockets.
2381 ****************************************************************************/
2382
2383 NTSTATUS cli_connect(struct cli_state *cli,
2384                 const char *host,
2385                 struct sockaddr_storage *dest_ss)
2386
2387 {
2388         int name_type = 0x20;
2389         TALLOC_CTX *frame = talloc_stackframe();
2390         unsigned int num_addrs = 0;
2391         unsigned int i = 0;
2392         struct sockaddr_storage *ss_arr = NULL;
2393         char *p = NULL;
2394
2395         /* reasonable default hostname */
2396         if (!host) {
2397                 host = STAR_SMBSERVER;
2398         }
2399
2400         fstrcpy(cli->desthost, host);
2401
2402         /* allow hostnames of the form NAME#xx and do a netbios lookup */
2403         if ((p = strchr(cli->desthost, '#'))) {
2404                 name_type = strtol(p+1, NULL, 16);
2405                 *p = 0;
2406         }
2407
2408         if (!dest_ss || is_zero_addr((struct sockaddr *)dest_ss)) {
2409                 NTSTATUS status =resolve_name_list(frame,
2410                                         cli->desthost,
2411                                         name_type,
2412                                         &ss_arr,
2413                                         &num_addrs);
2414                 if (!NT_STATUS_IS_OK(status)) {
2415                         TALLOC_FREE(frame);
2416                         return NT_STATUS_BAD_NETWORK_NAME;
2417                 }
2418         } else {
2419                 num_addrs = 1;
2420                 ss_arr = TALLOC_P(frame, struct sockaddr_storage);
2421                 if (!ss_arr) {
2422                         TALLOC_FREE(frame);
2423                         return NT_STATUS_NO_MEMORY;
2424                 }
2425                 *ss_arr = *dest_ss;
2426         }
2427
2428         for (i = 0; i < num_addrs; i++) {
2429                 cli->dest_ss = ss_arr[i];
2430                 if (getenv("LIBSMB_PROG")) {
2431                         cli->fd = sock_exec(getenv("LIBSMB_PROG"));
2432                 } else {
2433                         uint16_t port = cli->port;
2434                         NTSTATUS status;
2435                         status = open_smb_socket(&cli->dest_ss, &port,
2436                                                  cli->timeout, &cli->fd);
2437                         if (NT_STATUS_IS_OK(status)) {
2438                                 cli->port = port;
2439                         }
2440                 }
2441                 if (cli->fd == -1) {
2442                         char addr[INET6_ADDRSTRLEN];
2443                         print_sockaddr(addr, sizeof(addr), &ss_arr[i]);
2444                         DEBUG(2,("Error connecting to %s (%s)\n",
2445                                  dest_ss?addr:host,strerror(errno)));
2446                 } else {
2447                         /* Exit from loop on first connection. */
2448                         break;
2449                 }
2450         }
2451
2452         if (cli->fd == -1) {
2453                 TALLOC_FREE(frame);
2454                 return map_nt_error_from_unix(errno);
2455         }
2456
2457         if (dest_ss) {
2458                 *dest_ss = cli->dest_ss;
2459         }
2460
2461         set_socket_options(cli->fd, lp_socket_options());
2462
2463         TALLOC_FREE(frame);
2464         return NT_STATUS_OK;
2465 }
2466
2467 /**
2468    establishes a connection to after the negprot.
2469    @param output_cli A fully initialised cli structure, non-null only on success
2470    @param dest_host The netbios name of the remote host
2471    @param dest_ss (optional) The the destination IP, NULL for name based lookup
2472    @param port (optional) The destination port (0 for default)
2473    @param retry bool. Did this connection fail with a retryable error ?
2474
2475 */
2476 NTSTATUS cli_start_connection(struct cli_state **output_cli,
2477                               const char *my_name,
2478                               const char *dest_host,
2479                               struct sockaddr_storage *dest_ss, int port,
2480                               int signing_state, int flags,
2481                               bool *retry)
2482 {
2483         NTSTATUS nt_status;
2484         struct nmb_name calling;
2485         struct nmb_name called;
2486         struct cli_state *cli;
2487         struct sockaddr_storage ss;
2488
2489         if (retry)
2490                 *retry = False;
2491
2492         if (!my_name)
2493                 my_name = global_myname();
2494
2495         if (!(cli = cli_initialise_ex(signing_state))) {
2496                 return NT_STATUS_NO_MEMORY;
2497         }
2498
2499         make_nmb_name(&calling, my_name, 0x0);
2500         make_nmb_name(&called , dest_host, 0x20);
2501
2502         cli_set_port(cli, port);
2503         cli_set_timeout(cli, 10000); /* 10 seconds. */
2504
2505         if (dest_ss) {
2506                 ss = *dest_ss;
2507         } else {
2508                 zero_sockaddr(&ss);
2509         }
2510
2511 again:
2512
2513         DEBUG(3,("Connecting to host=%s\n", dest_host));
2514
2515         nt_status = cli_connect(cli, dest_host, &ss);
2516         if (!NT_STATUS_IS_OK(nt_status)) {
2517                 char addr[INET6_ADDRSTRLEN];
2518                 print_sockaddr(addr, sizeof(addr), &ss);
2519                 DEBUG(1,("cli_start_connection: failed to connect to %s (%s). Error %s\n",
2520                          nmb_namestr(&called), addr, nt_errstr(nt_status) ));
2521                 cli_shutdown(cli);
2522                 return nt_status;
2523         }
2524
2525         if (retry)
2526                 *retry = True;
2527
2528         if (!cli_session_request(cli, &calling, &called)) {
2529                 char *p;
2530                 DEBUG(1,("session request to %s failed (%s)\n",
2531                          called.name, cli_errstr(cli)));
2532                 if ((p=strchr(called.name, '.')) && !is_ipaddress(called.name)) {
2533                         *p = 0;
2534                         goto again;
2535                 }
2536                 if (strcmp(called.name, STAR_SMBSERVER)) {
2537                         make_nmb_name(&called , STAR_SMBSERVER, 0x20);
2538                         goto again;
2539                 }
2540                 return NT_STATUS_BAD_NETWORK_NAME;
2541         }
2542
2543         if (flags & CLI_FULL_CONNECTION_DONT_SPNEGO)
2544                 cli->use_spnego = False;
2545         else if (flags & CLI_FULL_CONNECTION_USE_KERBEROS)
2546                 cli->use_kerberos = True;
2547
2548         if ((flags & CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS) &&
2549              cli->use_kerberos) {
2550                 cli->fallback_after_kerberos = true;
2551         }
2552
2553         nt_status = cli_negprot(cli);
2554         if (!NT_STATUS_IS_OK(nt_status)) {
2555                 DEBUG(1, ("failed negprot: %s\n", nt_errstr(nt_status)));
2556                 cli_shutdown(cli);
2557                 return nt_status;
2558         }
2559
2560         *output_cli = cli;
2561         return NT_STATUS_OK;
2562 }
2563
2564
2565 /**
2566    establishes a connection right up to doing tconX, password specified.
2567    @param output_cli A fully initialised cli structure, non-null only on success
2568    @param dest_host The netbios name of the remote host
2569    @param dest_ip (optional) The the destination IP, NULL for name based lookup
2570    @param port (optional) The destination port (0 for default)
2571    @param service (optional) The share to make the connection to.  Should be 'unqualified' in any way.
2572    @param service_type The 'type' of serivice.
2573    @param user Username, unix string
2574    @param domain User's domain
2575    @param password User's password, unencrypted unix string.
2576    @param retry bool. Did this connection fail with a retryable error ?
2577 */
2578
2579 NTSTATUS cli_full_connection(struct cli_state **output_cli,
2580                              const char *my_name,
2581                              const char *dest_host,
2582                              struct sockaddr_storage *dest_ss, int port,
2583                              const char *service, const char *service_type,
2584                              const char *user, const char *domain,
2585                              const char *password, int flags,
2586                              int signing_state,
2587                              bool *retry)
2588 {
2589         NTSTATUS nt_status;
2590         struct cli_state *cli = NULL;
2591         int pw_len = password ? strlen(password)+1 : 0;
2592
2593         *output_cli = NULL;
2594
2595         if (password == NULL) {
2596                 password = "";
2597         }
2598
2599         nt_status = cli_start_connection(&cli, my_name, dest_host,
2600                                          dest_ss, port, signing_state,
2601                                          flags, retry);
2602
2603         if (!NT_STATUS_IS_OK(nt_status)) {
2604                 return nt_status;
2605         }
2606
2607         cli->use_oplocks = ((flags & CLI_FULL_CONNECTION_OPLOCKS) != 0);
2608         cli->use_level_II_oplocks =
2609                 ((flags & CLI_FULL_CONNECTION_LEVEL_II_OPLOCKS) != 0);
2610
2611         nt_status = cli_session_setup(cli, user, password, pw_len, password,
2612                                       pw_len, domain);
2613         if (!NT_STATUS_IS_OK(nt_status)) {
2614
2615                 if (!(flags & CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK)) {
2616                         DEBUG(1,("failed session setup with %s\n",
2617                                  nt_errstr(nt_status)));
2618                         cli_shutdown(cli);
2619                         return nt_status;
2620                 }
2621
2622                 nt_status = cli_session_setup(cli, "", "", 0, "", 0, domain);
2623                 if (!NT_STATUS_IS_OK(nt_status)) {
2624                         DEBUG(1,("anonymous failed session setup with %s\n",
2625                                  nt_errstr(nt_status)));
2626                         cli_shutdown(cli);
2627                         return nt_status;
2628                 }
2629         }
2630
2631         if (service) {
2632                 nt_status = cli_tcon_andx(cli, service, service_type, password,
2633                                           pw_len);
2634                 if (!NT_STATUS_IS_OK(nt_status)) {
2635                         DEBUG(1,("failed tcon_X with %s\n", nt_errstr(nt_status)));
2636                         cli_shutdown(cli);
2637                         if (NT_STATUS_IS_OK(nt_status)) {
2638                                 nt_status = NT_STATUS_UNSUCCESSFUL;
2639                         }
2640                         return nt_status;
2641                 }
2642         }
2643
2644         nt_status = cli_init_creds(cli, user, domain, password);
2645         if (!NT_STATUS_IS_OK(nt_status)) {
2646                 cli_shutdown(cli);
2647                 return nt_status;
2648         }
2649
2650         *output_cli = cli;
2651         return NT_STATUS_OK;
2652 }
2653
2654 /****************************************************************************
2655  Attempt a NetBIOS session request, falling back to *SMBSERVER if needed.
2656 ****************************************************************************/
2657
2658 bool attempt_netbios_session_request(struct cli_state **ppcli, const char *srchost, const char *desthost,
2659                                      struct sockaddr_storage *pdest_ss)
2660 {
2661         struct nmb_name calling, called;
2662
2663         make_nmb_name(&calling, srchost, 0x0);
2664
2665         /*
2666          * If the called name is an IP address
2667          * then use *SMBSERVER immediately.
2668          */
2669
2670         if(is_ipaddress(desthost)) {
2671                 make_nmb_name(&called, STAR_SMBSERVER, 0x20);
2672         } else {
2673                 make_nmb_name(&called, desthost, 0x20);
2674         }
2675
2676         if (!cli_session_request(*ppcli, &calling, &called)) {
2677                 NTSTATUS status;
2678                 struct nmb_name smbservername;
2679
2680                 make_nmb_name(&smbservername, STAR_SMBSERVER, 0x20);
2681
2682                 /*
2683                  * If the name wasn't *SMBSERVER then
2684                  * try with *SMBSERVER if the first name fails.
2685                  */
2686
2687                 if (nmb_name_equal(&called, &smbservername)) {
2688
2689                         /*
2690                          * The name used was *SMBSERVER, don't bother with another name.
2691                          */
2692
2693                         DEBUG(0,("attempt_netbios_session_request: %s rejected the session for name *SMBSERVER \
2694 with error %s.\n", desthost, cli_errstr(*ppcli) ));
2695                         return False;
2696                 }
2697
2698                 /* Try again... */
2699                 cli_shutdown(*ppcli);
2700
2701                 *ppcli = cli_initialise();
2702                 if (!*ppcli) {
2703                         /* Out of memory... */
2704                         return False;
2705                 }
2706
2707                 status = cli_connect(*ppcli, desthost, pdest_ss);
2708                 if (!NT_STATUS_IS_OK(status) ||
2709                                 !cli_session_request(*ppcli, &calling, &smbservername)) {
2710                         DEBUG(0,("attempt_netbios_session_request: %s rejected the session for \
2711 name *SMBSERVER with error %s\n", desthost, cli_errstr(*ppcli) ));
2712                         return False;
2713                 }
2714         }
2715
2716         return True;
2717 }
2718
2719 /****************************************************************************
2720  Send an old style tcon.
2721 ****************************************************************************/
2722 NTSTATUS cli_raw_tcon(struct cli_state *cli,
2723                       const char *service, const char *pass, const char *dev,
2724                       uint16 *max_xmit, uint16 *tid)
2725 {
2726         char *p;
2727
2728         if (!lp_client_plaintext_auth() && (*pass)) {
2729                 DEBUG(1, ("Server requested plaintext password but 'client "
2730                           "plaintext auth' is disabled\n"));
2731                 return NT_STATUS_ACCESS_DENIED;
2732         }
2733
2734         memset(cli->outbuf,'\0',smb_size);
2735         memset(cli->inbuf,'\0',smb_size);
2736
2737         cli_set_message(cli->outbuf, 0, 0, True);
2738         SCVAL(cli->outbuf,smb_com,SMBtcon);
2739         cli_setup_packet(cli);
2740
2741         p = smb_buf(cli->outbuf);
2742         *p++ = 4; p += clistr_push(cli, p, service, -1, STR_TERMINATE | STR_NOALIGN);
2743         *p++ = 4; p += clistr_push(cli, p, pass, -1, STR_TERMINATE | STR_NOALIGN);
2744         *p++ = 4; p += clistr_push(cli, p, dev, -1, STR_TERMINATE | STR_NOALIGN);
2745
2746         cli_setup_bcc(cli, p);
2747
2748         cli_send_smb(cli);
2749         if (!cli_receive_smb(cli)) {
2750                 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
2751         }
2752
2753         if (cli_is_error(cli)) {
2754                 return cli_nt_error(cli);
2755         }
2756
2757         *max_xmit = SVAL(cli->inbuf, smb_vwv0);
2758         *tid = SVAL(cli->inbuf, smb_vwv1);
2759
2760         return NT_STATUS_OK;
2761 }
2762
2763 /* Return a cli_state pointing at the IPC$ share for the given server */
2764
2765 struct cli_state *get_ipc_connect(char *server,
2766                                 struct sockaddr_storage *server_ss,
2767                                 const struct user_auth_info *user_info)
2768 {
2769         struct cli_state *cli;
2770         NTSTATUS nt_status;
2771         uint32_t flags = CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK;
2772
2773         if (user_info->use_kerberos) {
2774                 flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
2775         }
2776
2777         nt_status = cli_full_connection(&cli, NULL, server, server_ss, 0, "IPC$", "IPC",
2778                                         user_info->username ? user_info->username : "",
2779                                         lp_workgroup(),
2780                                         user_info->password ? user_info->password : "",
2781                                         flags,
2782                                         Undefined, NULL);
2783
2784         if (NT_STATUS_IS_OK(nt_status)) {
2785                 return cli;
2786         } else if (is_ipaddress(server)) {
2787             /* windows 9* needs a correct NMB name for connections */
2788             fstring remote_name;
2789
2790             if (name_status_find("*", 0, 0, server_ss, remote_name)) {
2791                 cli = get_ipc_connect(remote_name, server_ss, user_info);
2792                 if (cli)
2793                     return cli;
2794             }
2795         }
2796         return NULL;
2797 }
2798
2799 /*
2800  * Given the IP address of a master browser on the network, return its
2801  * workgroup and connect to it.
2802  *
2803  * This function is provided to allow additional processing beyond what
2804  * get_ipc_connect_master_ip_bcast() does, e.g. to retrieve the list of master
2805  * browsers and obtain each master browsers' list of domains (in case the
2806  * first master browser is recently on the network and has not yet
2807  * synchronized with other master browsers and therefore does not yet have the
2808  * entire network browse list)
2809  */
2810
2811 struct cli_state *get_ipc_connect_master_ip(TALLOC_CTX *ctx,
2812                                 struct ip_service *mb_ip,
2813                                 const struct user_auth_info *user_info,
2814                                 char **pp_workgroup_out)
2815 {
2816         char addr[INET6_ADDRSTRLEN];
2817         fstring name;
2818         struct cli_state *cli;
2819         struct sockaddr_storage server_ss;
2820
2821         *pp_workgroup_out = NULL;
2822
2823         print_sockaddr(addr, sizeof(addr), &mb_ip->ss);
2824         DEBUG(99, ("Looking up name of master browser %s\n",
2825                    addr));
2826
2827         /*
2828          * Do a name status query to find out the name of the master browser.
2829          * We use <01><02>__MSBROWSE__<02>#01 if *#00 fails because a domain
2830          * master browser will not respond to a wildcard query (or, at least,
2831          * an NT4 server acting as the domain master browser will not).
2832          *
2833          * We might be able to use ONLY the query on MSBROWSE, but that's not
2834          * yet been tested with all Windows versions, so until it is, leave
2835          * the original wildcard query as the first choice and fall back to
2836          * MSBROWSE if the wildcard query fails.
2837          */
2838         if (!name_status_find("*", 0, 0x1d, &mb_ip->ss, name) &&
2839             !name_status_find(MSBROWSE, 1, 0x1d, &mb_ip->ss, name)) {
2840
2841                 DEBUG(99, ("Could not retrieve name status for %s\n",
2842                            addr));
2843                 return NULL;
2844         }
2845
2846         if (!find_master_ip(name, &server_ss)) {
2847                 DEBUG(99, ("Could not find master ip for %s\n", name));
2848                 return NULL;
2849         }
2850
2851         *pp_workgroup_out = talloc_strdup(ctx, name);
2852
2853         DEBUG(4, ("found master browser %s, %s\n", name, addr));
2854
2855         print_sockaddr(addr, sizeof(addr), &server_ss);
2856         cli = get_ipc_connect(addr, &server_ss, user_info);
2857
2858         return cli;
2859 }
2860
2861 /*
2862  * Return the IP address and workgroup of a master browser on the network, and
2863  * connect to it.
2864  */
2865
2866 struct cli_state *get_ipc_connect_master_ip_bcast(TALLOC_CTX *ctx,
2867                                         const struct user_auth_info *user_info,
2868                                         char **pp_workgroup_out)
2869 {
2870         struct ip_service *ip_list;
2871         struct cli_state *cli;
2872         int i, count;
2873
2874         *pp_workgroup_out = NULL;
2875
2876         DEBUG(99, ("Do broadcast lookup for workgroups on local network\n"));
2877
2878         /* Go looking for workgroups by broadcasting on the local network */
2879
2880         if (!NT_STATUS_IS_OK(name_resolve_bcast(MSBROWSE, 1, &ip_list,
2881                                                 &count))) {
2882                 DEBUG(99, ("No master browsers responded\n"));
2883                 return False;
2884         }
2885
2886         for (i = 0; i < count; i++) {
2887                 char addr[INET6_ADDRSTRLEN];
2888                 print_sockaddr(addr, sizeof(addr), &ip_list[i].ss);
2889                 DEBUG(99, ("Found master browser %s\n", addr));
2890
2891                 cli = get_ipc_connect_master_ip(ctx, &ip_list[i],
2892                                 user_info, pp_workgroup_out);
2893                 if (cli)
2894                         return(cli);
2895         }
2896
2897         return NULL;
2898 }