bb08b22c8dcb4747325ede655eb558d778718038
[kai/samba.git] / source3 / libsmb / clidfs.c
1 /*
2    Unix SMB/CIFS implementation.
3    client connect/disconnect routines
4    Copyright (C) Andrew Tridgell                  1994-1998
5    Copyright (C) Gerald (Jerry) Carter            2004
6    Copyright (C) Jeremy Allison                   2007-2009
7
8    This program is free software; you can redistribute it and/or modify
9    it under the terms of the GNU General Public License as published by
10    the Free Software Foundation; either version 3 of the License, or
11    (at your option) any later version.
12
13    This program is distributed in the hope that it will be useful,
14    but WITHOUT ANY WARRANTY; without even the implied warranty of
15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16    GNU General Public License for more details.
17
18    You should have received a copy of the GNU General Public License
19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "libsmb/libsmb.h"
24 #include "libsmb/clirap.h"
25 #include "msdfs.h"
26 #include "trans2.h"
27 #include "libsmb/nmblib.h"
28
29 /********************************************************************
30  Important point.
31
32  DFS paths are *always* of the form \server\share\<pathname> (the \ characters
33  are not C escaped here).
34
35  - but if we're using POSIX paths then <pathname> may contain
36    '/' separators, not '\\' separators. So cope with '\\' or '/'
37    as a separator when looking at the pathname part.... JRA.
38 ********************************************************************/
39
40 /********************************************************************
41  Ensure a connection is encrypted.
42 ********************************************************************/
43
44 NTSTATUS cli_cm_force_encryption(struct cli_state *c,
45                         const char *username,
46                         const char *password,
47                         const char *domain,
48                         const char *sharename)
49 {
50         NTSTATUS status = cli_force_encryption(c,
51                                         username,
52                                         password,
53                                         domain);
54
55         if (NT_STATUS_EQUAL(status,NT_STATUS_NOT_SUPPORTED)) {
56                 d_printf("Encryption required and "
57                         "server that doesn't support "
58                         "UNIX extensions - failing connect\n");
59         } else if (NT_STATUS_EQUAL(status,NT_STATUS_UNKNOWN_REVISION)) {
60                 d_printf("Encryption required and "
61                         "can't get UNIX CIFS extensions "
62                         "version from server.\n");
63         } else if (NT_STATUS_EQUAL(status,NT_STATUS_UNSUPPORTED_COMPRESSION)) {
64                 d_printf("Encryption required and "
65                         "share %s doesn't support "
66                         "encryption.\n", sharename);
67         } else if (!NT_STATUS_IS_OK(status)) {
68                 d_printf("Encryption required and "
69                         "setup failed with error %s.\n",
70                         nt_errstr(status));
71         }
72
73         return status;
74 }
75
76 /********************************************************************
77  Return a connection to a server.
78 ********************************************************************/
79
80 static NTSTATUS do_connect(TALLOC_CTX *ctx,
81                                         const char *server,
82                                         const char *share,
83                                         const struct user_auth_info *auth_info,
84                                         bool show_sessetup,
85                                         bool force_encrypt,
86                                         int max_protocol,
87                                         int port,
88                                         int name_type,
89                                         struct cli_state **pcli)
90 {
91         struct cli_state *c = NULL;
92         char *servicename;
93         char *sharename;
94         char *newserver, *newshare;
95         const char *username;
96         const char *password;
97         NTSTATUS status;
98
99         /* make a copy so we don't modify the global string 'service' */
100         servicename = talloc_strdup(ctx,share);
101         if (!servicename) {
102                 return NT_STATUS_NO_MEMORY;
103         }
104         sharename = servicename;
105         if (*sharename == '\\') {
106                 sharename += 2;
107                 if (server == NULL) {
108                         server = sharename;
109                 }
110                 sharename = strchr_m(sharename,'\\');
111                 if (!sharename) {
112                         return NT_STATUS_NO_MEMORY;
113                 }
114                 *sharename = 0;
115                 sharename++;
116         }
117         if (server == NULL) {
118                 return NT_STATUS_INVALID_PARAMETER;
119         }
120
121         status = cli_connect_nb(
122                 server, NULL, port, name_type, NULL,
123                 get_cmdline_auth_info_signing_state(auth_info), &c);
124
125         if (!NT_STATUS_IS_OK(status)) {
126                 d_printf("Connection to %s failed (Error %s)\n",
127                                 server,
128                                 nt_errstr(status));
129                 return status;
130         }
131
132         if (max_protocol == 0) {
133                 max_protocol = PROTOCOL_NT1;
134         }
135         c->protocol = max_protocol;
136         c->use_kerberos = get_cmdline_auth_info_use_kerberos(auth_info);
137         c->fallback_after_kerberos =
138                 get_cmdline_auth_info_fallback_after_kerberos(auth_info);
139         c->use_ccache = get_cmdline_auth_info_use_ccache(auth_info);
140
141         DEBUG(4,(" session request ok\n"));
142
143         status = cli_negprot(c);
144
145         if (!NT_STATUS_IS_OK(status)) {
146                 d_printf("protocol negotiation failed: %s\n",
147                          nt_errstr(status));
148                 cli_shutdown(c);
149                 return status;
150         }
151
152         username = get_cmdline_auth_info_username(auth_info);
153         password = get_cmdline_auth_info_password(auth_info);
154
155         status = cli_session_setup(c, username,
156                                    password, strlen(password),
157                                    password, strlen(password),
158                                    lp_workgroup());
159         if (!NT_STATUS_IS_OK(status)) {
160                 /* If a password was not supplied then
161                  * try again with a null username. */
162                 if (password[0] || !username[0] ||
163                         get_cmdline_auth_info_use_kerberos(auth_info) ||
164                         !NT_STATUS_IS_OK(status = cli_session_setup(c, "",
165                                                 "", 0,
166                                                 "", 0,
167                                                lp_workgroup()))) {
168                         d_printf("session setup failed: %s\n",
169                                  nt_errstr(status));
170                         if (NT_STATUS_V(cli_nt_error(c)) ==
171                             NT_STATUS_V(NT_STATUS_MORE_PROCESSING_REQUIRED))
172                                 d_printf("did you forget to run kinit?\n");
173                         cli_shutdown(c);
174                         return status;
175                 }
176                 d_printf("Anonymous login successful\n");
177                 status = cli_init_creds(c, "", lp_workgroup(), "");
178         } else {
179                 status = cli_init_creds(c, username, lp_workgroup(), password);
180         }
181
182         if (!NT_STATUS_IS_OK(status)) {
183                 DEBUG(10,("cli_init_creds() failed: %s\n", nt_errstr(status)));
184                 cli_shutdown(c);
185                 return status;
186         }
187
188         if ( show_sessetup ) {
189                 if (*c->server_domain) {
190                         DEBUG(0,("Domain=[%s] OS=[%s] Server=[%s]\n",
191                                 c->server_domain,c->server_os,c->server_type));
192                 } else if (*c->server_os || *c->server_type) {
193                         DEBUG(0,("OS=[%s] Server=[%s]\n",
194                                  c->server_os,c->server_type));
195                 }
196         }
197         DEBUG(4,(" session setup ok\n"));
198
199         /* here's the fun part....to support 'msdfs proxy' shares
200            (on Samba or windows) we have to issues a TRANS_GET_DFS_REFERRAL
201            here before trying to connect to the original share.
202            cli_check_msdfs_proxy() will fail if it is a normal share. */
203
204         if ((c->capabilities & CAP_DFS) &&
205                         cli_check_msdfs_proxy(ctx, c, sharename,
206                                 &newserver, &newshare,
207                                 force_encrypt,
208                                 username,
209                                 password,
210                                 lp_workgroup())) {
211                 cli_shutdown(c);
212                 return do_connect(ctx, newserver,
213                                 newshare, auth_info, false,
214                                 force_encrypt, max_protocol,
215                                 port, name_type, pcli);
216         }
217
218         /* must be a normal share */
219
220         status = cli_tcon_andx(c, sharename, "?????",
221                                password, strlen(password)+1);
222         if (!NT_STATUS_IS_OK(status)) {
223                 d_printf("tree connect failed: %s\n", nt_errstr(status));
224                 cli_shutdown(c);
225                 return status;
226         }
227
228         if (force_encrypt) {
229                 status = cli_cm_force_encryption(c,
230                                         username,
231                                         password,
232                                         lp_workgroup(),
233                                         sharename);
234                 if (!NT_STATUS_IS_OK(status)) {
235                         cli_shutdown(c);
236                         return status;
237                 }
238         }
239
240         DEBUG(4,(" tconx ok\n"));
241         *pcli = c;
242         return NT_STATUS_OK;
243 }
244
245 /****************************************************************************
246 ****************************************************************************/
247
248 static void cli_set_mntpoint(struct cli_state *cli, const char *mnt)
249 {
250         char *name = clean_name(NULL, mnt);
251         if (!name) {
252                 return;
253         }
254         TALLOC_FREE(cli->dfs_mountpoint);
255         cli->dfs_mountpoint = talloc_strdup(cli, name);
256         TALLOC_FREE(name);
257 }
258
259 /********************************************************************
260  Add a new connection to the list.
261  referring_cli == NULL means a new initial connection.
262 ********************************************************************/
263
264 static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx,
265                                struct cli_state *referring_cli,
266                                const char *server,
267                                const char *share,
268                                const struct user_auth_info *auth_info,
269                                bool show_hdr,
270                                bool force_encrypt,
271                                int max_protocol,
272                                int port,
273                                int name_type,
274                                struct cli_state **pcli)
275 {
276         struct cli_state *cli;
277         NTSTATUS status;
278
279         status = do_connect(ctx, server, share,
280                                 auth_info,
281                                 show_hdr, force_encrypt, max_protocol,
282                                 port, name_type, &cli);
283
284         if (!NT_STATUS_IS_OK(status)) {
285                 return status;
286         }
287
288         /* Enter into the list. */
289         if (referring_cli) {
290                 DLIST_ADD_END(referring_cli, cli, struct cli_state *);
291         }
292
293         if (referring_cli && referring_cli->requested_posix_capabilities) {
294                 uint16 major, minor;
295                 uint32 caplow, caphigh;
296                 status = cli_unix_extensions_version(cli, &major, &minor,
297                                                      &caplow, &caphigh);
298                 if (NT_STATUS_IS_OK(status)) {
299                         cli_set_unix_extensions_capabilities(cli,
300                                         major, minor,
301                                         caplow, caphigh);
302                 }
303         }
304
305         *pcli = cli;
306         return NT_STATUS_OK;
307 }
308
309 /********************************************************************
310  Return a connection to a server on a particular share.
311 ********************************************************************/
312
313 static struct cli_state *cli_cm_find(struct cli_state *cli,
314                                 const char *server,
315                                 const char *share)
316 {
317         struct cli_state *p;
318
319         if (cli == NULL) {
320                 return NULL;
321         }
322
323         /* Search to the start of the list. */
324         for (p = cli; p; p = DLIST_PREV(p)) {
325                 if (strequal(server, p->desthost) &&
326                                 strequal(share,p->share)) {
327                         return p;
328                 }
329         }
330
331         /* Search to the end of the list. */
332         for (p = cli->next; p; p = p->next) {
333                 if (strequal(server, p->desthost) &&
334                                 strequal(share,p->share)) {
335                         return p;
336                 }
337         }
338
339         return NULL;
340 }
341
342 /****************************************************************************
343  Open a client connection to a \\server\share.
344 ****************************************************************************/
345
346 NTSTATUS cli_cm_open(TALLOC_CTX *ctx,
347                                 struct cli_state *referring_cli,
348                                 const char *server,
349                                 const char *share,
350                                 const struct user_auth_info *auth_info,
351                                 bool show_hdr,
352                                 bool force_encrypt,
353                                 int max_protocol,
354                                 int port,
355                                 int name_type,
356                                 struct cli_state **pcli)
357 {
358         /* Try to reuse an existing connection in this list. */
359         struct cli_state *c = cli_cm_find(referring_cli, server, share);
360         NTSTATUS status;
361
362         if (c) {
363                 *pcli = c;
364                 return NT_STATUS_OK;
365         }
366
367         if (auth_info == NULL) {
368                 /* Can't do a new connection
369                  * without auth info. */
370                 d_printf("cli_cm_open() Unable to open connection [\\%s\\%s] "
371                         "without auth info\n",
372                         server, share );
373                 return NT_STATUS_INVALID_PARAMETER;
374         }
375
376         status = cli_cm_connect(ctx,
377                                 referring_cli,
378                                 server,
379                                 share,
380                                 auth_info,
381                                 show_hdr,
382                                 force_encrypt,
383                                 max_protocol,
384                                 port,
385                                 name_type,
386                                 &c);
387         if (!NT_STATUS_IS_OK(status)) {
388                 return status;
389         }
390         *pcli = c;
391         return NT_STATUS_OK;
392 }
393
394 /****************************************************************************
395 ****************************************************************************/
396
397 void cli_cm_display(const struct cli_state *cli)
398 {
399         int i;
400
401         for (i=0; cli; cli = cli->next,i++ ) {
402                 d_printf("%d:\tserver=%s, share=%s\n",
403                         i, cli->desthost, cli->share );
404         }
405 }
406
407 /****************************************************************************
408 ****************************************************************************/
409
410 /****************************************************************************
411 ****************************************************************************/
412
413 #if 0
414 void cli_cm_set_credentials(struct user_auth_info *auth_info)
415 {
416         SAFE_FREE(cm_creds.username);
417         cm_creds.username = SMB_STRDUP(get_cmdline_auth_info_username(
418                                                auth_info));
419
420         if (get_cmdline_auth_info_got_pass(auth_info)) {
421                 cm_set_password(get_cmdline_auth_info_password(auth_info));
422         }
423
424         cm_creds.use_kerberos = get_cmdline_auth_info_use_kerberos(auth_info);
425         cm_creds.fallback_after_kerberos = false;
426         cm_creds.signing_state = get_cmdline_auth_info_signing_state(auth_info);
427 }
428 #endif
429
430 /**********************************************************************
431  split a dfs path into the server, share name, and extrapath components
432 **********************************************************************/
433
434 static bool split_dfs_path(TALLOC_CTX *ctx,
435                                 const char *nodepath,
436                                 char **pp_server,
437                                 char **pp_share,
438                                 char **pp_extrapath)
439 {
440         char *p, *q;
441         char *path;
442
443         *pp_server = NULL;
444         *pp_share = NULL;
445         *pp_extrapath = NULL;
446
447         path = talloc_strdup(ctx, nodepath);
448         if (!path) {
449                 goto fail;
450         }
451
452         if ( path[0] != '\\' ) {
453                 goto fail;
454         }
455
456         p = strchr_m( path + 1, '\\' );
457         if ( !p ) {
458                 goto fail;
459         }
460
461         *p = '\0';
462         p++;
463
464         /* Look for any extra/deep path */
465         q = strchr_m(p, '\\');
466         if (q != NULL) {
467                 *q = '\0';
468                 q++;
469                 *pp_extrapath = talloc_strdup(ctx, q);
470         } else {
471                 *pp_extrapath = talloc_strdup(ctx, "");
472         }
473         if (*pp_extrapath == NULL) {
474                 goto fail;
475         }
476
477         *pp_share = talloc_strdup(ctx, p);
478         if (*pp_share == NULL) {
479                 goto fail;
480         }
481
482         *pp_server = talloc_strdup(ctx, &path[1]);
483         if (*pp_server == NULL) {
484                 goto fail;
485         }
486
487         TALLOC_FREE(path);
488         return true;
489
490 fail:
491         TALLOC_FREE(*pp_share);
492         TALLOC_FREE(*pp_extrapath);
493         TALLOC_FREE(path);
494         return false;
495 }
496
497 /****************************************************************************
498  Return the original path truncated at the directory component before
499  the first wildcard character. Trust the caller to provide a NULL
500  terminated string
501 ****************************************************************************/
502
503 static char *clean_path(TALLOC_CTX *ctx, const char *path)
504 {
505         size_t len;
506         char *p1, *p2, *p;
507         char *path_out;
508
509         /* No absolute paths. */
510         while (IS_DIRECTORY_SEP(*path)) {
511                 path++;
512         }
513
514         path_out = talloc_strdup(ctx, path);
515         if (!path_out) {
516                 return NULL;
517         }
518
519         p1 = strchr_m(path_out, '*');
520         p2 = strchr_m(path_out, '?');
521
522         if (p1 || p2) {
523                 if (p1 && p2) {
524                         p = MIN(p1,p2);
525                 } else if (!p1) {
526                         p = p2;
527                 } else {
528                         p = p1;
529                 }
530                 *p = '\0';
531
532                 /* Now go back to the start of this component. */
533                 p1 = strrchr_m(path_out, '/');
534                 p2 = strrchr_m(path_out, '\\');
535                 p = MAX(p1,p2);
536                 if (p) {
537                         *p = '\0';
538                 }
539         }
540
541         /* Strip any trailing separator */
542
543         len = strlen(path_out);
544         if ( (len > 0) && IS_DIRECTORY_SEP(path_out[len-1])) {
545                 path_out[len-1] = '\0';
546         }
547
548         return path_out;
549 }
550
551 /****************************************************************************
552 ****************************************************************************/
553
554 static char *cli_dfs_make_full_path(TALLOC_CTX *ctx,
555                                         struct cli_state *cli,
556                                         const char *dir)
557 {
558         char path_sep = '\\';
559
560         /* Ensure the extrapath doesn't start with a separator. */
561         while (IS_DIRECTORY_SEP(*dir)) {
562                 dir++;
563         }
564
565         if (cli->requested_posix_capabilities & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
566                 path_sep = '/';
567         }
568         return talloc_asprintf(ctx, "%c%s%c%s%c%s",
569                         path_sep,
570                         cli->desthost,
571                         path_sep,
572                         cli->share,
573                         path_sep,
574                         dir);
575 }
576
577 /********************************************************************
578  check for dfs referral
579 ********************************************************************/
580
581 static bool cli_dfs_check_error(struct cli_state *cli, NTSTATUS expected,
582                                 NTSTATUS status)
583 {
584         /* only deal with DS when we negotiated NT_STATUS codes and UNICODE */
585
586         if (!(cli->capabilities & CAP_UNICODE)) {
587                 return false;
588         }
589         if (!(cli->capabilities & CAP_STATUS32)) {
590                 return false;
591         }
592         if (NT_STATUS_EQUAL(status, expected)) {
593                 return true;
594         }
595         return false;
596 }
597
598 /********************************************************************
599  Get the dfs referral link.
600 ********************************************************************/
601
602 NTSTATUS cli_dfs_get_referral(TALLOC_CTX *ctx,
603                         struct cli_state *cli,
604                         const char *path,
605                         struct client_dfs_referral **refs,
606                         size_t *num_refs,
607                         size_t *consumed)
608 {
609         unsigned int data_len = 0;
610         unsigned int param_len = 0;
611         uint16 setup[1];
612         uint8_t *param = NULL;
613         uint8_t *rdata = NULL;
614         char *p;
615         char *endp;
616         size_t pathlen = 2*(strlen(path)+1);
617         smb_ucs2_t *path_ucs;
618         char *consumed_path = NULL;
619         uint16_t consumed_ucs;
620         uint16 num_referrals;
621         struct client_dfs_referral *referrals = NULL;
622         NTSTATUS status;
623
624         *num_refs = 0;
625         *refs = NULL;
626
627         SSVAL(setup, 0, TRANSACT2_GET_DFS_REFERRAL);
628
629         param = SMB_MALLOC_ARRAY(uint8_t, 2+pathlen+2);
630         if (!param) {
631                 status = NT_STATUS_NO_MEMORY;
632                 goto out;
633         }
634         SSVAL(param, 0, 0x03);  /* max referral level */
635         p = (char *)(&param[2]);
636
637         path_ucs = (smb_ucs2_t *)p;
638         p += clistr_push(cli, p, path, pathlen, STR_TERMINATE);
639         param_len = PTR_DIFF(p, param);
640
641         status = cli_trans(talloc_tos(), cli, SMBtrans2,
642                            NULL, 0xffff, 0, 0,
643                            setup, 1, 0,
644                            param, param_len, 2,
645                            NULL, 0, cli->max_xmit,
646                            NULL,
647                            NULL, 0, NULL, /* rsetup */
648                            NULL, 0, NULL,
649                            &rdata, 4, &data_len);
650         if (!NT_STATUS_IS_OK(status)) {
651                 goto out;
652         }
653         if (data_len < 4) {
654                 goto out;
655         }
656
657         endp = (char *)rdata + data_len;
658
659         consumed_ucs  = SVAL(rdata, 0);
660         num_referrals = SVAL(rdata, 2);
661
662         /* consumed_ucs is the number of bytes
663          * of the UCS2 path consumed not counting any
664          * terminating null. We need to convert
665          * back to unix charset and count again
666          * to get the number of bytes consumed from
667          * the incoming path. */
668
669         if (pull_string_talloc(talloc_tos(),
670                         NULL,
671                         0,
672                         &consumed_path,
673                         path_ucs,
674                         consumed_ucs,
675                         STR_UNICODE) == 0) {
676                 goto out;
677         }
678         if (consumed_path == NULL) {
679                 goto out;
680         }
681         *consumed = strlen(consumed_path);
682
683         if (num_referrals != 0) {
684                 uint16 ref_version;
685                 uint16 ref_size;
686                 int i;
687                 uint16 node_offset;
688
689                 referrals = talloc_array(ctx, struct client_dfs_referral,
690                                          num_referrals);
691
692                 if (!referrals) {
693                         goto out;
694                 }
695                 /* start at the referrals array */
696
697                 p = (char *)rdata+8;
698                 for (i=0; i<num_referrals && p < endp; i++) {
699                         if (p + 18 > endp) {
700                                 goto out;
701                         }
702                         ref_version = SVAL(p, 0);
703                         ref_size    = SVAL(p, 2);
704                         node_offset = SVAL(p, 16);
705
706                         if (ref_version != 3) {
707                                 p += ref_size;
708                                 continue;
709                         }
710
711                         referrals[i].proximity = SVAL(p, 8);
712                         referrals[i].ttl       = SVAL(p, 10);
713
714                         if (p + node_offset > endp) {
715                                 goto out;
716                         }
717                         clistr_pull_talloc(ctx, cli->inbuf,
718                                            SVAL(cli->inbuf, smb_flg2),
719                                            &referrals[i].dfspath,
720                                            p+node_offset,
721                                            cli->bufsize - ((p+node_offset)-cli->inbuf),
722                                            STR_TERMINATE|STR_UNICODE);
723
724                         if (!referrals[i].dfspath) {
725                                 goto out;
726                         }
727                         p += ref_size;
728                 }
729                 if (i < num_referrals) {
730                         goto out;
731                 }
732         }
733
734         *num_refs = num_referrals;
735         *refs = referrals;
736
737   out:
738
739         TALLOC_FREE(consumed_path);
740         SAFE_FREE(param);
741         TALLOC_FREE(rdata);
742         return status;
743 }
744
745 /********************************************************************
746 ********************************************************************/
747
748 bool cli_resolve_path(TALLOC_CTX *ctx,
749                         const char *mountpt,
750                         const struct user_auth_info *dfs_auth_info,
751                         struct cli_state *rootcli,
752                         const char *path,
753                         struct cli_state **targetcli,
754                         char **pp_targetpath)
755 {
756         struct client_dfs_referral *refs = NULL;
757         size_t num_refs = 0;
758         size_t consumed = 0;
759         struct cli_state *cli_ipc = NULL;
760         char *dfs_path = NULL;
761         char *cleanpath = NULL;
762         char *extrapath = NULL;
763         int pathlen;
764         char *server = NULL;
765         char *share = NULL;
766         struct cli_state *newcli = NULL;
767         char *newpath = NULL;
768         char *newmount = NULL;
769         char *ppath = NULL;
770         SMB_STRUCT_STAT sbuf;
771         uint32 attributes;
772         NTSTATUS status;
773
774         if ( !rootcli || !path || !targetcli ) {
775                 return false;
776         }
777
778         /* Don't do anything if this is not a DFS root. */
779
780         if ( !rootcli->dfsroot) {
781                 *targetcli = rootcli;
782                 *pp_targetpath = talloc_strdup(ctx, path);
783                 if (!*pp_targetpath) {
784                         return false;
785                 }
786                 return true;
787         }
788
789         *targetcli = NULL;
790
791         /* Send a trans2_query_path_info to check for a referral. */
792
793         cleanpath = clean_path(ctx, path);
794         if (!cleanpath) {
795                 return false;
796         }
797
798         dfs_path = cli_dfs_make_full_path(ctx, rootcli, cleanpath);
799         if (!dfs_path) {
800                 return false;
801         }
802
803         status = cli_qpathinfo_basic( rootcli, dfs_path, &sbuf, &attributes);
804         if (NT_STATUS_IS_OK(status)) {
805                 /* This is an ordinary path, just return it. */
806                 *targetcli = rootcli;
807                 *pp_targetpath = talloc_strdup(ctx, path);
808                 if (!*pp_targetpath) {
809                         return false;
810                 }
811                 goto done;
812         }
813
814         /* Special case where client asked for a path that does not exist */
815
816         if (cli_dfs_check_error(rootcli, NT_STATUS_OBJECT_NAME_NOT_FOUND,
817                                 status)) {
818                 *targetcli = rootcli;
819                 *pp_targetpath = talloc_strdup(ctx, path);
820                 if (!*pp_targetpath) {
821                         return false;
822                 }
823                 goto done;
824         }
825
826         /* We got an error, check for DFS referral. */
827
828         if (!cli_dfs_check_error(rootcli, NT_STATUS_PATH_NOT_COVERED,
829                                  status)) {
830                 return false;
831         }
832
833         /* Check for the referral. */
834
835         status = cli_cm_open(ctx,
836                              rootcli,
837                              rootcli->desthost,
838                              "IPC$",
839                              dfs_auth_info,
840                              false,
841                              (rootcli->trans_enc_state != NULL),
842                              rootcli->protocol,
843                              0,
844                              0x20,
845                              &cli_ipc);
846         if (!NT_STATUS_IS_OK(status)) {
847                 return false;
848         }
849
850         status = cli_dfs_get_referral(ctx, cli_ipc, dfs_path, &refs,
851                                       &num_refs, &consumed);
852         if (!NT_STATUS_IS_OK(status) || !num_refs) {
853                 return false;
854         }
855
856         /* Just store the first referral for now. */
857
858         if (!refs[0].dfspath) {
859                 return false;
860         }
861         if (!split_dfs_path(ctx, refs[0].dfspath, &server, &share,
862                             &extrapath)) {
863                 return false;
864         }
865
866         /* Make sure to recreate the original string including any wildcards. */
867
868         dfs_path = cli_dfs_make_full_path(ctx, rootcli, path);
869         if (!dfs_path) {
870                 return false;
871         }
872         pathlen = strlen(dfs_path);
873         consumed = MIN(pathlen, consumed);
874         *pp_targetpath = talloc_strdup(ctx, &dfs_path[consumed]);
875         if (!*pp_targetpath) {
876                 return false;
877         }
878         dfs_path[consumed] = '\0';
879
880         /*
881          * *pp_targetpath is now the unconsumed part of the path.
882          * dfs_path is now the consumed part of the path
883          * (in \server\share\path format).
884          */
885
886         /* Open the connection to the target server & share */
887         status = cli_cm_open(ctx, rootcli,
888                              server,
889                              share,
890                              dfs_auth_info,
891                              false,
892                              (rootcli->trans_enc_state != NULL),
893                              rootcli->protocol,
894                              0,
895                              0x20,
896                              targetcli);
897         if (!NT_STATUS_IS_OK(status)) {
898                 d_printf("Unable to follow dfs referral [\\%s\\%s]\n",
899                         server, share );
900                 return false;
901         }
902
903         if (extrapath && strlen(extrapath) > 0) {
904                 /* EMC Celerra NAS version 5.6.50 (at least) doesn't appear to */
905                 /* put the trailing \ on the path, so to be save we put one in if needed */
906                 if (extrapath[strlen(extrapath)-1] != '\\' && **pp_targetpath != '\\') {
907                         *pp_targetpath = talloc_asprintf(ctx,
908                                                   "%s\\%s",
909                                                   extrapath,
910                                                   *pp_targetpath);
911                 } else {
912                         *pp_targetpath = talloc_asprintf(ctx,
913                                                   "%s%s",
914                                                   extrapath,
915                                                   *pp_targetpath);
916                 }
917                 if (!*pp_targetpath) {
918                         return false;
919                 }
920         }
921
922         /* parse out the consumed mount path */
923         /* trim off the \server\share\ */
924
925         ppath = dfs_path;
926
927         if (*ppath != '\\') {
928                 d_printf("cli_resolve_path: "
929                         "dfs_path (%s) not in correct format.\n",
930                         dfs_path );
931                 return false;
932         }
933
934         ppath++; /* Now pointing at start of server name. */
935
936         if ((ppath = strchr_m( dfs_path, '\\' )) == NULL) {
937                 return false;
938         }
939
940         ppath++; /* Now pointing at start of share name. */
941
942         if ((ppath = strchr_m( ppath+1, '\\' )) == NULL) {
943                 return false;
944         }
945
946         ppath++; /* Now pointing at path component. */
947
948         newmount = talloc_asprintf(ctx, "%s\\%s", mountpt, ppath );
949         if (!newmount) {
950                 return false;
951         }
952
953         cli_set_mntpoint(*targetcli, newmount);
954
955         /* Check for another dfs referral, note that we are not
956            checking for loops here. */
957
958         if (!strequal(*pp_targetpath, "\\") && !strequal(*pp_targetpath, "/")) {
959                 if (cli_resolve_path(ctx,
960                                         newmount,
961                                         dfs_auth_info,
962                                         *targetcli,
963                                         *pp_targetpath,
964                                         &newcli,
965                                         &newpath)) {
966                         /*
967                          * When cli_resolve_path returns true here it's always
968                          * returning the complete path in newpath, so we're done
969                          * here.
970                          */
971                         *targetcli = newcli;
972                         *pp_targetpath = newpath;
973                         return true;
974                 }
975         }
976
977   done:
978
979         /* If returning true ensure we return a dfs root full path. */
980         if ((*targetcli)->dfsroot) {
981                 dfs_path = talloc_strdup(ctx, *pp_targetpath);
982                 if (!dfs_path) {
983                         return false;
984                 }
985                 *pp_targetpath = cli_dfs_make_full_path(ctx, *targetcli, dfs_path);
986         }
987
988         return true;
989 }
990
991 /********************************************************************
992 ********************************************************************/
993
994 bool cli_check_msdfs_proxy(TALLOC_CTX *ctx,
995                                 struct cli_state *cli,
996                                 const char *sharename,
997                                 char **pp_newserver,
998                                 char **pp_newshare,
999                                 bool force_encrypt,
1000                                 const char *username,
1001                                 const char *password,
1002                                 const char *domain)
1003 {
1004         struct client_dfs_referral *refs = NULL;
1005         size_t num_refs = 0;
1006         size_t consumed = 0;
1007         char *fullpath = NULL;
1008         bool res;
1009         uint16 cnum;
1010         char *newextrapath = NULL;
1011         NTSTATUS status;
1012
1013         if (!cli || !sharename) {
1014                 return false;
1015         }
1016
1017         cnum = cli->cnum;
1018
1019         /* special case.  never check for a referral on the IPC$ share */
1020
1021         if (strequal(sharename, "IPC$")) {
1022                 return false;
1023         }
1024
1025         /* send a trans2_query_path_info to check for a referral */
1026
1027         fullpath = talloc_asprintf(ctx, "\\%s\\%s", cli->desthost, sharename );
1028         if (!fullpath) {
1029                 return false;
1030         }
1031
1032         /* check for the referral */
1033
1034         if (!NT_STATUS_IS_OK(cli_tcon_andx(cli, "IPC$", "IPC", NULL, 0))) {
1035                 return false;
1036         }
1037
1038         if (force_encrypt) {
1039                 status = cli_cm_force_encryption(cli,
1040                                         username,
1041                                         password,
1042                                         lp_workgroup(),
1043                                         "IPC$");
1044                 if (!NT_STATUS_IS_OK(status)) {
1045                         return false;
1046                 }
1047         }
1048
1049         status = cli_dfs_get_referral(ctx, cli, fullpath, &refs,
1050                                       &num_refs, &consumed);
1051         res = NT_STATUS_IS_OK(status);
1052
1053         status = cli_tdis(cli);
1054         if (!NT_STATUS_IS_OK(status)) {
1055                 return false;
1056         }
1057
1058         cli->cnum = cnum;
1059
1060         if (!res || !num_refs) {
1061                 return false;
1062         }
1063
1064         if (!refs[0].dfspath) {
1065                 return false;
1066         }
1067
1068         if (!split_dfs_path(ctx, refs[0].dfspath, pp_newserver,
1069                             pp_newshare, &newextrapath)) {
1070                 return false;
1071         }
1072
1073         /* check that this is not a self-referral */
1074
1075         if (strequal(cli->desthost, *pp_newserver) &&
1076                         strequal(sharename, *pp_newshare)) {
1077                 return false;
1078         }
1079
1080         return true;
1081 }