source3/libsmb/cliconnect.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    client connect/disconnect routines
   4    Copyright (C) Andrew Tridgell 1994-1998
   5    Copyright (C) Andrew Bartlett 2001-2003
   6    Copyright (C) Volker Lendecke 2011
   7    Copyright (C) Jeremy Allison 2011
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "libsmb/libsmb.h"
  25 #include "popt_common.h"
  26 #include "../libcli/auth/libcli_auth.h"
  27 #include "../libcli/auth/spnego.h"
  28 #include "smb_krb5.h"
  29 #include "../auth/ntlmssp/ntlmssp.h"
  30 #include "libads/kerberos_proto.h"
  31 #include "krb5_env.h"
  32 #include "../lib/util/tevent_ntstatus.h"
  33 #include "async_smb.h"
  34 #include "libsmb/nmblib.h"
  35 #include "librpc/ndr/libndr.h"
  36 #include "../libcli/smb/smbXcli_base.h"
  37 #include "smb2cli.h"
  38
  39 #define STAR_SMBSERVER "*SMBSERVER"
  40
  41 /********************************************************
  42  Utility function to ensure we always return at least
  43  a valid char * pointer to an empty string for the
  44  cli->server_os, cli->server_type and cli->server_domain
  45  strings.
  46 *******************************************************/
  47
  48 static NTSTATUS smb_bytes_talloc_string(TALLOC_CTX *mem_ctx,
  49                                         char *inbuf,
  50                                         char **dest,
  51                                         uint8_t *src,
  52                                         size_t srclen,
  53                                         ssize_t *destlen)
  54 {
  55         *destlen = clistr_pull_talloc(mem_ctx,
  56                                 inbuf,
  57                                 SVAL(inbuf, smb_flg2),
  58                                 dest,
  59                                 (char *)src,
  60                                 srclen,
  61                                 STR_TERMINATE);
  62         if (*destlen == -1) {
  63                 return NT_STATUS_NO_MEMORY;
  64         }
  65
  66         if (*dest == NULL) {
  67                 *dest = talloc_strdup(mem_ctx, "");
  68                 if (*dest == NULL) {
  69                         return NT_STATUS_NO_MEMORY;
  70                 }
  71         }
  72         return NT_STATUS_OK;
  73 }
  74
  75 /**
  76  * Set the user session key for a connection
  77  * @param cli The cli structure to add it too
  78  * @param session_key The session key used.  (A copy of this is taken for the cli struct)
  79  *
  80  */
  81
  82 static void cli_set_session_key (struct cli_state *cli, const DATA_BLOB session_key)
  83 {
  84         cli->user_session_key = data_blob(session_key.data, session_key.length);
  85 }
  86
  87 /****************************************************************************
  88  Do an old lanman2 style session setup.
  89 ****************************************************************************/
  90
  91 struct cli_session_setup_lanman2_state {
  92         struct cli_state *cli;
  93         uint16_t vwv[10];
  94         const char *user;
  95 };
  96
  97 static void cli_session_setup_lanman2_done(struct tevent_req *subreq);
  98
  99 static struct tevent_req *cli_session_setup_lanman2_send(
 100         TALLOC_CTX *mem_ctx, struct tevent_context *ev,
 101         struct cli_state *cli, const char *user,
 102         const char *pass, size_t passlen,
 103         const char *workgroup)
 104 {
 105         struct tevent_req *req, *subreq;
 106         struct cli_session_setup_lanman2_state *state;
 107         DATA_BLOB lm_response = data_blob_null;
 108         uint16_t *vwv;
 109         uint8_t *bytes;
 110         char *tmp;
 111         uint16_t sec_mode = cli_state_security_mode(cli);
 112
 113         req = tevent_req_create(mem_ctx, &state,
 114                                 struct cli_session_setup_lanman2_state);
 115         if (req == NULL) {
 116                 return NULL;
 117         }
 118         state->cli = cli;
 119         state->user = user;
 120         vwv = state->vwv;
 121
 122         /*
 123          * if in share level security then don't send a password now
 124          */
 125         if (!(sec_mode & NEGOTIATE_SECURITY_USER_LEVEL)) {
 126                 passlen = 0;
 127         }
 128
 129         if (passlen > 0
 130             && (sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE)
 131             && passlen != 24) {
 132                 /*
 133                  * Encrypted mode needed, and non encrypted password
 134                  * supplied.
 135                  */
 136                 lm_response = data_blob(NULL, 24);
 137                 if (tevent_req_nomem(lm_response.data, req)) {
 138                         return tevent_req_post(req, ev);
 139                 }
 140
 141                 if (!SMBencrypt(pass, cli_state_server_challenge(cli),
 142                                 (uint8_t *)lm_response.data)) {
 143                         DEBUG(1, ("Password is > 14 chars in length, and is "
 144                                   "therefore incompatible with Lanman "
 145                                   "authentication\n"));
 146                         tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
 147                         return tevent_req_post(req, ev);
 148                 }
 149         } else if ((sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE)
 150                    && passlen == 24) {
 151                 /*
 152                  * Encrypted mode needed, and encrypted password
 153                  * supplied.
 154                  */
 155                 lm_response = data_blob(pass, passlen);
 156                 if (tevent_req_nomem(lm_response.data, req)) {
 157                         return tevent_req_post(req, ev);
 158                 }
 159         } else if (passlen > 0) {
 160                 uint8_t *buf;
 161                 size_t converted_size;
 162                 /*
 163                  * Plaintext mode needed, assume plaintext supplied.
 164                  */
 165                 buf = talloc_array(talloc_tos(), uint8_t, 0);
 166                 buf = smb_bytes_push_str(buf, cli_ucs2(cli), pass, passlen+1,
 167                                          &converted_size);
 168                 if (tevent_req_nomem(buf, req)) {
 169                         return tevent_req_post(req, ev);
 170                 }
 171                 lm_response = data_blob(pass, passlen);
 172                 TALLOC_FREE(buf);
 173                 if (tevent_req_nomem(lm_response.data, req)) {
 174                         return tevent_req_post(req, ev);
 175                 }
 176         }
 177
 178         SCVAL(vwv+0, 0, 0xff);
 179         SCVAL(vwv+0, 1, 0);
 180         SSVAL(vwv+1, 0, 0);
 181         SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
 182         SSVAL(vwv+3, 0, 2);
 183         SSVAL(vwv+4, 0, 1);
 184         SIVAL(vwv+5, 0, cli_state_server_session_key(cli));
 185         SSVAL(vwv+7, 0, lm_response.length);
 186
 187         bytes = talloc_array(state, uint8_t, lm_response.length);
 188         if (tevent_req_nomem(bytes, req)) {
 189                 return tevent_req_post(req, ev);
 190         }
 191         if (lm_response.length != 0) {
 192                 memcpy(bytes, lm_response.data, lm_response.length);
 193         }
 194         data_blob_free(&lm_response);
 195
 196         tmp = talloc_strdup_upper(talloc_tos(), user);
 197         if (tevent_req_nomem(tmp, req)) {
 198                 return tevent_req_post(req, ev);
 199         }
 200         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), tmp, strlen(tmp)+1,
 201                                    NULL);
 202         TALLOC_FREE(tmp);
 203
 204         tmp = talloc_strdup_upper(talloc_tos(), workgroup);
 205         if (tevent_req_nomem(tmp, req)) {
 206                 return tevent_req_post(req, ev);
 207         }
 208         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), tmp, strlen(tmp)+1,
 209                                    NULL);
 210         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Unix", 5, NULL);
 211         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Samba", 6, NULL);
 212
 213         if (tevent_req_nomem(bytes, req)) {
 214                 return tevent_req_post(req, ev);
 215         }
 216
 217         subreq = cli_smb_send(state, ev, cli, SMBsesssetupX, 0, 10, vwv,
 218                               talloc_get_size(bytes), bytes);
 219         if (tevent_req_nomem(subreq, req)) {
 220                 return tevent_req_post(req, ev);
 221         }
 222         tevent_req_set_callback(subreq, cli_session_setup_lanman2_done, req);
 223         return req;
 224 }
 225
 226 static void cli_session_setup_lanman2_done(struct tevent_req *subreq)
 227 {
 228         struct tevent_req *req = tevent_req_callback_data(
 229                 subreq, struct tevent_req);
 230         struct cli_session_setup_lanman2_state *state = tevent_req_data(
 231                 req, struct cli_session_setup_lanman2_state);
 232         struct cli_state *cli = state->cli;
 233         uint32_t num_bytes;
 234         uint8_t *in;
 235         char *inbuf;
 236         uint8_t *bytes;
 237         uint8_t *p;
 238         NTSTATUS status;
 239         ssize_t ret;
 240         uint8_t wct;
 241         uint16_t *vwv;
 242
 243         status = cli_smb_recv(subreq, state, &in, 3, &wct, &vwv,
 244                               &num_bytes, &bytes);
 245         TALLOC_FREE(subreq);
 246         if (!NT_STATUS_IS_OK(status)) {
 247                 tevent_req_nterror(req, status);
 248                 return;
 249         }
 250
 251         inbuf = (char *)in;
 252         p = bytes;
 253
 254         cli_state_set_uid(state->cli, SVAL(inbuf, smb_uid));
 255         cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
 256
 257         status = smb_bytes_talloc_string(cli,
 258                                         inbuf,
 259                                         &cli->server_os,
 260                                         p,
 261                                         bytes+num_bytes-p,
 262                                         &ret);
 263
 264         if (!NT_STATUS_IS_OK(status)) {
 265                 tevent_req_nterror(req, status);
 266                 return;
 267         }
 268         p += ret;
 269
 270         status = smb_bytes_talloc_string(cli,
 271                                         inbuf,
 272                                         &cli->server_type,
 273                                         p,
 274                                         bytes+num_bytes-p,
 275                                         &ret);
 276
 277         if (!NT_STATUS_IS_OK(status)) {
 278                 tevent_req_nterror(req, status);
 279                 return;
 280         }
 281         p += ret;
 282
 283         status = smb_bytes_talloc_string(cli,
 284                                         inbuf,
 285                                         &cli->server_domain,
 286                                         p,
 287                                         bytes+num_bytes-p,
 288                                         &ret);
 289
 290         if (!NT_STATUS_IS_OK(status)) {
 291                 tevent_req_nterror(req, status);
 292                 return;
 293         }
 294         p += ret;
 295
 296         status = cli_set_username(cli, state->user);
 297         if (tevent_req_nterror(req, status)) {
 298                 return;
 299         }
 300         tevent_req_done(req);
 301 }
 302
 303 static NTSTATUS cli_session_setup_lanman2_recv(struct tevent_req *req)
 304 {
 305         return tevent_req_simple_recv_ntstatus(req);
 306 }
 307
 308 static NTSTATUS cli_session_setup_lanman2(struct cli_state *cli, const char *user,
 309                                           const char *pass, size_t passlen,
 310                                           const char *workgroup)
 311 {
 312         TALLOC_CTX *frame = talloc_stackframe();
 313         struct event_context *ev;
 314         struct tevent_req *req;
 315         NTSTATUS status = NT_STATUS_NO_MEMORY;
 316
 317         if (cli_has_async_calls(cli)) {
 318                 /*
 319                  * Can't use sync call while an async call is in flight
 320                  */
 321                 status = NT_STATUS_INVALID_PARAMETER;
 322                 goto fail;
 323         }
 324         ev = event_context_init(frame);
 325         if (ev == NULL) {
 326                 goto fail;
 327         }
 328         req = cli_session_setup_lanman2_send(frame, ev, cli, user, pass, passlen,
 329                                              workgroup);
 330         if (req == NULL) {
 331                 goto fail;
 332         }
 333         if (!tevent_req_poll_ntstatus(req, ev, &status)) {
 334                 goto fail;
 335         }
 336         status = cli_session_setup_lanman2_recv(req);
 337  fail:
 338         TALLOC_FREE(frame);
 339         return status;
 340 }
 341
 342 /****************************************************************************
 343  Work out suitable capabilities to offer the server.
 344 ****************************************************************************/
 345
 346 static uint32_t cli_session_setup_capabilities(struct cli_state *cli,
 347                                                uint32_t sesssetup_capabilities)
 348 {
 349         uint32_t client_capabilities = cli_state_capabilities(cli);
 350
 351         /*
 352          * We only send capabilities based on the mask for:
 353          * - client only flags
 354          * - flags used in both directions
 355          *
 356          * We do not echo the server only flags.
 357          */
 358         client_capabilities &= (SMB_CAP_BOTH_MASK | SMB_CAP_CLIENT_MASK);
 359
 360         /*
 361          * Session Setup specific flags CAP_DYNAMIC_REAUTH
 362          * and CAP_EXTENDED_SECURITY are passed by the caller.
 363          * We need that in order to do guest logins even if
 364          * CAP_EXTENDED_SECURITY is negotiated.
 365          */
 366         client_capabilities &= ~(CAP_DYNAMIC_REAUTH|CAP_EXTENDED_SECURITY);
 367         sesssetup_capabilities &= (CAP_DYNAMIC_REAUTH|CAP_EXTENDED_SECURITY);
 368         client_capabilities |= sesssetup_capabilities;
 369
 370         return client_capabilities;
 371 }
 372
 373 /****************************************************************************
 374  Do a NT1 guest session setup.
 375 ****************************************************************************/
 376
 377 struct cli_session_setup_guest_state {
 378         struct cli_state *cli;
 379         uint16_t vwv[13];
 380         struct iovec bytes;
 381 };
 382
 383 static void cli_session_setup_guest_done(struct tevent_req *subreq);
 384
 385 struct tevent_req *cli_session_setup_guest_create(TALLOC_CTX *mem_ctx,
 386                                                   struct event_context *ev,
 387                                                   struct cli_state *cli,
 388                                                   struct tevent_req **psmbreq)
 389 {
 390         struct tevent_req *req, *subreq;
 391         struct cli_session_setup_guest_state *state;
 392         uint16_t *vwv;
 393         uint8_t *bytes;
 394
 395         req = tevent_req_create(mem_ctx, &state,
 396                                 struct cli_session_setup_guest_state);
 397         if (req == NULL) {
 398                 return NULL;
 399         }
 400         state->cli = cli;
 401         vwv = state->vwv;
 402
 403         SCVAL(vwv+0, 0, 0xFF);
 404         SCVAL(vwv+0, 1, 0);
 405         SSVAL(vwv+1, 0, 0);
 406         SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
 407         SSVAL(vwv+3, 0, 2);
 408         SSVAL(vwv+4, 0, cli_state_get_vc_num(cli));
 409         SIVAL(vwv+5, 0, cli_state_server_session_key(cli));
 410         SSVAL(vwv+7, 0, 0);
 411         SSVAL(vwv+8, 0, 0);
 412         SSVAL(vwv+9, 0, 0);
 413         SSVAL(vwv+10, 0, 0);
 414         SIVAL(vwv+11, 0, cli_session_setup_capabilities(cli, 0));
 415
 416         bytes = talloc_array(state, uint8_t, 0);
 417
 418         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "",  1, /* username */
 419                                    NULL);
 420         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "", 1, /* workgroup */
 421                                    NULL);
 422         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Unix", 5, NULL);
 423         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Samba", 6, NULL);
 424
 425         if (bytes == NULL) {
 426                 TALLOC_FREE(req);
 427                 return NULL;
 428         }
 429
 430         state->bytes.iov_base = (void *)bytes;
 431         state->bytes.iov_len = talloc_get_size(bytes);
 432
 433         subreq = cli_smb_req_create(state, ev, cli, SMBsesssetupX, 0, 13, vwv,
 434                                     1, &state->bytes);
 435         if (subreq == NULL) {
 436                 TALLOC_FREE(req);
 437                 return NULL;
 438         }
 439         tevent_req_set_callback(subreq, cli_session_setup_guest_done, req);
 440         *psmbreq = subreq;
 441         return req;
 442 }
 443
 444 struct tevent_req *cli_session_setup_guest_send(TALLOC_CTX *mem_ctx,
 445                                                 struct event_context *ev,
 446                                                 struct cli_state *cli)
 447 {
 448         struct tevent_req *req, *subreq;
 449         NTSTATUS status;
 450
 451         req = cli_session_setup_guest_create(mem_ctx, ev, cli, &subreq);
 452         if (req == NULL) {
 453                 return NULL;
 454         }
 455
 456         status = cli_smb_req_send(subreq);
 457         if (NT_STATUS_IS_OK(status)) {
 458                 tevent_req_nterror(req, status);
 459                 return tevent_req_post(req, ev);
 460         }
 461         return req;
 462 }
 463
 464 static void cli_session_setup_guest_done(struct tevent_req *subreq)
 465 {
 466         struct tevent_req *req = tevent_req_callback_data(
 467                 subreq, struct tevent_req);
 468         struct cli_session_setup_guest_state *state = tevent_req_data(
 469                 req, struct cli_session_setup_guest_state);
 470         struct cli_state *cli = state->cli;
 471         uint32_t num_bytes;
 472         uint8_t *in;
 473         char *inbuf;
 474         uint8_t *bytes;
 475         uint8_t *p;
 476         NTSTATUS status;
 477         ssize_t ret;
 478         uint8_t wct;
 479         uint16_t *vwv;
 480
 481         status = cli_smb_recv(subreq, state, &in, 3, &wct, &vwv,
 482                               &num_bytes, &bytes);
 483         TALLOC_FREE(subreq);
 484         if (!NT_STATUS_IS_OK(status)) {
 485                 tevent_req_nterror(req, status);
 486                 return;
 487         }
 488
 489         inbuf = (char *)in;
 490         p = bytes;
 491
 492         cli_state_set_uid(state->cli, SVAL(inbuf, smb_uid));
 493         cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
 494
 495         status = smb_bytes_talloc_string(cli,
 496                                         inbuf,
 497                                         &cli->server_os,
 498                                         p,
 499                                         bytes+num_bytes-p,
 500                                         &ret);
 501
 502         if (!NT_STATUS_IS_OK(status)) {
 503                 tevent_req_nterror(req, status);
 504                 return;
 505         }
 506         p += ret;
 507
 508         status = smb_bytes_talloc_string(cli,
 509                                         inbuf,
 510                                         &cli->server_type,
 511                                         p,
 512                                         bytes+num_bytes-p,
 513                                         &ret);
 514
 515         if (!NT_STATUS_IS_OK(status)) {
 516                 tevent_req_nterror(req, status);
 517                 return;
 518         }
 519         p += ret;
 520
 521         status = smb_bytes_talloc_string(cli,
 522                                         inbuf,
 523                                         &cli->server_domain,
 524                                         p,
 525                                         bytes+num_bytes-p,
 526                                         &ret);
 527
 528         if (!NT_STATUS_IS_OK(status)) {
 529                 tevent_req_nterror(req, status);
 530                 return;
 531         }
 532         p += ret;
 533
 534         status = cli_set_username(cli, "");
 535         if (!NT_STATUS_IS_OK(status)) {
 536                 tevent_req_nterror(req, status);
 537                 return;
 538         }
 539         tevent_req_done(req);
 540 }
 541
 542 NTSTATUS cli_session_setup_guest_recv(struct tevent_req *req)
 543 {
 544         return tevent_req_simple_recv_ntstatus(req);
 545 }
 546
 547 static NTSTATUS cli_session_setup_guest(struct cli_state *cli)
 548 {
 549         TALLOC_CTX *frame = talloc_stackframe();
 550         struct event_context *ev;
 551         struct tevent_req *req;
 552         NTSTATUS status = NT_STATUS_OK;
 553
 554         if (cli_has_async_calls(cli)) {
 555                 /*
 556                  * Can't use sync call while an async call is in flight
 557                  */
 558                 status = NT_STATUS_INVALID_PARAMETER;
 559                 goto fail;
 560         }
 561
 562         ev = event_context_init(frame);
 563         if (ev == NULL) {
 564                 status = NT_STATUS_NO_MEMORY;
 565                 goto fail;
 566         }
 567
 568         req = cli_session_setup_guest_send(frame, ev, cli);
 569         if (req == NULL) {
 570                 status = NT_STATUS_NO_MEMORY;
 571                 goto fail;
 572         }
 573
 574         if (!tevent_req_poll(req, ev)) {
 575                 status = map_nt_error_from_unix(errno);
 576                 goto fail;
 577         }
 578
 579         status = cli_session_setup_guest_recv(req);
 580  fail:
 581         TALLOC_FREE(frame);
 582         return status;
 583 }
 584
 585 /****************************************************************************
 586  Do a NT1 plaintext session setup.
 587 ****************************************************************************/
 588
 589 struct cli_session_setup_plain_state {
 590         struct cli_state *cli;
 591         uint16_t vwv[13];
 592         const char *user;
 593 };
 594
 595 static void cli_session_setup_plain_done(struct tevent_req *subreq);
 596
 597 static struct tevent_req *cli_session_setup_plain_send(
 598         TALLOC_CTX *mem_ctx, struct tevent_context *ev,
 599         struct cli_state *cli,
 600         const char *user, const char *pass, const char *workgroup)
 601 {
 602         struct tevent_req *req, *subreq;
 603         struct cli_session_setup_plain_state *state;
 604         uint16_t *vwv;
 605         uint8_t *bytes;
 606         size_t passlen;
 607         char *version;
 608
 609         req = tevent_req_create(mem_ctx, &state,
 610                                 struct cli_session_setup_plain_state);
 611         if (req == NULL) {
 612                 return NULL;
 613         }
 614         state->cli = cli;
 615         state->user = user;
 616         vwv = state->vwv;
 617
 618         SCVAL(vwv+0, 0, 0xff);
 619         SCVAL(vwv+0, 1, 0);
 620         SSVAL(vwv+1, 0, 0);
 621         SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
 622         SSVAL(vwv+3, 0, 2);
 623         SSVAL(vwv+4, 0, cli_state_get_vc_num(cli));
 624         SIVAL(vwv+5, 0, cli_state_server_session_key(cli));
 625         SSVAL(vwv+7, 0, 0);
 626         SSVAL(vwv+8, 0, 0);
 627         SSVAL(vwv+9, 0, 0);
 628         SSVAL(vwv+10, 0, 0);
 629         SIVAL(vwv+11, 0, cli_session_setup_capabilities(cli, 0));
 630
 631         bytes = talloc_array(state, uint8_t, 0);
 632         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), pass, strlen(pass)+1,
 633                                    &passlen);
 634         if (tevent_req_nomem(bytes, req)) {
 635                 return tevent_req_post(req, ev);
 636         }
 637         SSVAL(vwv + (cli_ucs2(cli) ? 8 : 7), 0, passlen);
 638
 639         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
 640                                    user, strlen(user)+1, NULL);
 641         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
 642                                    workgroup, strlen(workgroup)+1, NULL);
 643         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
 644                                    "Unix", 5, NULL);
 645
 646         version = talloc_asprintf(talloc_tos(), "Samba %s",
 647                                   samba_version_string());
 648         if (tevent_req_nomem(version, req)){
 649                 return tevent_req_post(req, ev);
 650         }
 651         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
 652                                    version, strlen(version)+1, NULL);
 653         TALLOC_FREE(version);
 654
 655         if (tevent_req_nomem(bytes, req)) {
 656                 return tevent_req_post(req, ev);
 657         }
 658
 659         subreq = cli_smb_send(state, ev, cli, SMBsesssetupX, 0, 13, vwv,
 660                               talloc_get_size(bytes), bytes);
 661         if (tevent_req_nomem(subreq, req)) {
 662                 return tevent_req_post(req, ev);
 663         }
 664         tevent_req_set_callback(subreq, cli_session_setup_plain_done, req);
 665         return req;
 666 }
 667
 668 static void cli_session_setup_plain_done(struct tevent_req *subreq)
 669 {
 670         struct tevent_req *req = tevent_req_callback_data(
 671                 subreq, struct tevent_req);
 672         struct cli_session_setup_plain_state *state = tevent_req_data(
 673                 req, struct cli_session_setup_plain_state);
 674         struct cli_state *cli = state->cli;
 675         uint32_t num_bytes;
 676         uint8_t *in;
 677         char *inbuf;
 678         uint8_t *bytes;
 679         uint8_t *p;
 680         NTSTATUS status;
 681         ssize_t ret;
 682         uint8_t wct;
 683         uint16_t *vwv;
 684
 685         status = cli_smb_recv(subreq, state, &in, 3, &wct, &vwv,
 686                               &num_bytes, &bytes);
 687         TALLOC_FREE(subreq);
 688         if (tevent_req_nterror(req, status)) {
 689                 return;
 690         }
 691
 692         inbuf = (char *)in;
 693         p = bytes;
 694
 695         cli_state_set_uid(state->cli, SVAL(inbuf, smb_uid));
 696         cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
 697
 698         status = smb_bytes_talloc_string(cli,
 699                                         inbuf,
 700                                         &cli->server_os,
 701                                         p,
 702                                         bytes+num_bytes-p,
 703                                         &ret);
 704
 705         if (!NT_STATUS_IS_OK(status)) {
 706                 tevent_req_nterror(req, status);
 707                 return;
 708         }
 709         p += ret;
 710
 711         status = smb_bytes_talloc_string(cli,
 712                                         inbuf,
 713                                         &cli->server_type,
 714                                         p,
 715                                         bytes+num_bytes-p,
 716                                         &ret);
 717
 718         if (!NT_STATUS_IS_OK(status)) {
 719                 tevent_req_nterror(req, status);
 720                 return;
 721         }
 722         p += ret;
 723
 724         status = smb_bytes_talloc_string(cli,
 725                                         inbuf,
 726                                         &cli->server_domain,
 727                                         p,
 728                                         bytes+num_bytes-p,
 729                                         &ret);
 730
 731         if (!NT_STATUS_IS_OK(status)) {
 732                 tevent_req_nterror(req, status);
 733                 return;
 734         }
 735         p += ret;
 736
 737         status = cli_set_username(cli, state->user);
 738         if (tevent_req_nterror(req, status)) {
 739                 return;
 740         }
 741
 742         tevent_req_done(req);
 743 }
 744
 745 static NTSTATUS cli_session_setup_plain_recv(struct tevent_req *req)
 746 {
 747         return tevent_req_simple_recv_ntstatus(req);
 748 }
 749
 750 static NTSTATUS cli_session_setup_plain(struct cli_state *cli,
 751                                         const char *user, const char *pass,
 752                                         const char *workgroup)
 753 {
 754         TALLOC_CTX *frame = talloc_stackframe();
 755         struct event_context *ev;
 756         struct tevent_req *req;
 757         NTSTATUS status = NT_STATUS_NO_MEMORY;
 758
 759         if (cli_has_async_calls(cli)) {
 760                 /*
 761                  * Can't use sync call while an async call is in flight
 762                  */
 763                 status = NT_STATUS_INVALID_PARAMETER;
 764                 goto fail;
 765         }
 766         ev = event_context_init(frame);
 767         if (ev == NULL) {
 768                 goto fail;
 769         }
 770         req = cli_session_setup_plain_send(frame, ev, cli, user, pass,
 771                                            workgroup);
 772         if (req == NULL) {
 773                 goto fail;
 774         }
 775         if (!tevent_req_poll_ntstatus(req, ev, &status)) {
 776                 goto fail;
 777         }
 778         status = cli_session_setup_plain_recv(req);
 779  fail:
 780         TALLOC_FREE(frame);
 781         return status;
 782 }
 783
 784 /****************************************************************************
 785    do a NT1 NTLM/LM encrypted session setup - for when extended security
 786    is not negotiated.
 787    @param cli client state to create do session setup on
 788    @param user username
 789    @param pass *either* cleartext password (passlen !=24) or LM response.
 790    @param ntpass NT response, implies ntpasslen >=24, implies pass is not clear
 791    @param workgroup The user's domain.
 792 ****************************************************************************/
 793
 794 struct cli_session_setup_nt1_state {
 795         struct cli_state *cli;
 796         uint16_t vwv[13];
 797         DATA_BLOB response;
 798         DATA_BLOB session_key;
 799         const char *user;
 800 };
 801
 802 static void cli_session_setup_nt1_done(struct tevent_req *subreq);
 803
 804 static struct tevent_req *cli_session_setup_nt1_send(
 805         TALLOC_CTX *mem_ctx, struct tevent_context *ev,
 806         struct cli_state *cli, const char *user,
 807         const char *pass, size_t passlen,
 808         const char *ntpass, size_t ntpasslen,
 809         const char *workgroup)
 810 {
 811         struct tevent_req *req, *subreq;
 812         struct cli_session_setup_nt1_state *state;
 813         DATA_BLOB lm_response = data_blob_null;
 814         DATA_BLOB nt_response = data_blob_null;
 815         DATA_BLOB session_key = data_blob_null;
 816         uint16_t *vwv;
 817         uint8_t *bytes;
 818         char *workgroup_upper;
 819
 820         req = tevent_req_create(mem_ctx, &state,
 821                                 struct cli_session_setup_nt1_state);
 822         if (req == NULL) {
 823                 return NULL;
 824         }
 825         state->cli = cli;
 826         state->user = user;
 827         vwv = state->vwv;
 828
 829         if (passlen == 0) {
 830                 /* do nothing - guest login */
 831         } else if (passlen != 24) {
 832                 if (lp_client_ntlmv2_auth()) {
 833                         DATA_BLOB server_chal;
 834                         DATA_BLOB names_blob;
 835
 836                         server_chal =
 837                                 data_blob_const(cli_state_server_challenge(cli),
 838                                                 8);
 839
 840                         /*
 841                          * note that the 'workgroup' here is a best
 842                          * guess - we don't know the server's domain
 843                          * at this point. Windows clients also don't
 844                          * use hostname...
 845                          */
 846                         names_blob = NTLMv2_generate_names_blob(
 847                                 NULL, NULL, workgroup);
 848
 849                         if (tevent_req_nomem(names_blob.data, req)) {
 850                                 return tevent_req_post(req, ev);
 851                         }
 852
 853                         if (!SMBNTLMv2encrypt(NULL, user, workgroup, pass,
 854                                               &server_chal, &names_blob,
 855                                               &lm_response, &nt_response,
 856                                               NULL, &session_key)) {
 857                                 data_blob_free(&names_blob);
 858                                 tevent_req_nterror(
 859                                         req, NT_STATUS_ACCESS_DENIED);
 860                                 return tevent_req_post(req, ev);
 861                         }
 862                         data_blob_free(&names_blob);
 863
 864                 } else {
 865                         uchar nt_hash[16];
 866                         E_md4hash(pass, nt_hash);
 867
 868 #ifdef LANMAN_ONLY
 869                         nt_response = data_blob_null;
 870 #else
 871                         nt_response = data_blob(NULL, 24);
 872                         if (tevent_req_nomem(nt_response.data, req)) {
 873                                 return tevent_req_post(req, ev);
 874                         }
 875
 876                         SMBNTencrypt(pass, cli_state_server_challenge(cli),
 877                                      nt_response.data);
 878 #endif
 879                         /* non encrypted password supplied. Ignore ntpass. */
 880                         if (lp_client_lanman_auth()) {
 881
 882                                 lm_response = data_blob(NULL, 24);
 883                                 if (tevent_req_nomem(lm_response.data, req)) {
 884                                         return tevent_req_post(req, ev);
 885                                 }
 886
 887                                 if (!SMBencrypt(pass,
 888                                                 cli_state_server_challenge(cli),
 889                                                 lm_response.data)) {
 890                                         /*
 891                                          * Oops, the LM response is
 892                                          * invalid, just put the NT
 893                                          * response there instead
 894                                          */
 895                                         data_blob_free(&lm_response);
 896                                         lm_response = data_blob(
 897                                                 nt_response.data,
 898                                                 nt_response.length);
 899                                 }
 900                         } else {
 901                                 /*
 902                                  * LM disabled, place NT# in LM field
 903                                  * instead
 904                                  */
 905                                 lm_response = data_blob(
 906                                         nt_response.data, nt_response.length);
 907                         }
 908
 909                         if (tevent_req_nomem(lm_response.data, req)) {
 910                                 return tevent_req_post(req, ev);
 911                         }
 912
 913                         session_key = data_blob(NULL, 16);
 914                         if (tevent_req_nomem(session_key.data, req)) {
 915                                 return tevent_req_post(req, ev);
 916                         }
 917 #ifdef LANMAN_ONLY
 918                         E_deshash(pass, session_key.data);
 919                         memset(&session_key.data[8], '\0', 8);
 920 #else
 921                         SMBsesskeygen_ntv1(nt_hash, session_key.data);
 922 #endif
 923                 }
 924         } else {
 925                 /* pre-encrypted password supplied.  Only used for
 926                    security=server, can't do
 927                    signing because we don't have original key */
 928
 929                 lm_response = data_blob(pass, passlen);
 930                 if (tevent_req_nomem(lm_response.data, req)) {
 931                         return tevent_req_post(req, ev);
 932                 }
 933
 934                 nt_response = data_blob(ntpass, ntpasslen);
 935                 if (tevent_req_nomem(nt_response.data, req)) {
 936                         return tevent_req_post(req, ev);
 937                 }
 938         }
 939
 940 #ifdef LANMAN_ONLY
 941         state->response = data_blob_talloc(
 942                 state, lm_response.data, lm_response.length);
 943 #else
 944         state->response = data_blob_talloc(
 945                 state, nt_response.data, nt_response.length);
 946 #endif
 947         if (tevent_req_nomem(state->response.data, req)) {
 948                 return tevent_req_post(req, ev);
 949         }
 950
 951         if (session_key.data) {
 952                 state->session_key = data_blob_talloc(
 953                         state, session_key.data, session_key.length);
 954                 if (tevent_req_nomem(state->session_key.data, req)) {
 955                         return tevent_req_post(req, ev);
 956                 }
 957         }
 958         data_blob_free(&session_key);
 959
 960         SCVAL(vwv+0, 0, 0xff);
 961         SCVAL(vwv+0, 1, 0);
 962         SSVAL(vwv+1, 0, 0);
 963         SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
 964         SSVAL(vwv+3, 0, 2);
 965         SSVAL(vwv+4, 0, cli_state_get_vc_num(cli));
 966         SIVAL(vwv+5, 0, cli_state_server_session_key(cli));
 967         SSVAL(vwv+7, 0, lm_response.length);
 968         SSVAL(vwv+8, 0, nt_response.length);
 969         SSVAL(vwv+9, 0, 0);
 970         SSVAL(vwv+10, 0, 0);
 971         SIVAL(vwv+11, 0, cli_session_setup_capabilities(cli, 0));
 972
 973         bytes = talloc_array(state, uint8_t,
 974                              lm_response.length + nt_response.length);
 975         if (tevent_req_nomem(bytes, req)) {
 976                 return tevent_req_post(req, ev);
 977         }
 978         if (lm_response.length != 0) {
 979                 memcpy(bytes, lm_response.data, lm_response.length);
 980         }
 981         if (nt_response.length != 0) {
 982                 memcpy(bytes + lm_response.length,
 983                        nt_response.data, nt_response.length);
 984         }
 985         data_blob_free(&lm_response);
 986         data_blob_free(&nt_response);
 987
 988         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
 989                                    user, strlen(user)+1, NULL);
 990
 991         /*
 992          * Upper case here might help some NTLMv2 implementations
 993          */
 994         workgroup_upper = talloc_strdup_upper(talloc_tos(), workgroup);
 995         if (tevent_req_nomem(workgroup_upper, req)) {
 996                 return tevent_req_post(req, ev);
 997         }
 998         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
 999                                    workgroup_upper, strlen(workgroup_upper)+1,
1000                                    NULL);
1001         TALLOC_FREE(workgroup_upper);
1002
1003         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Unix", 5, NULL);
1004         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Samba", 6, NULL);
1005         if (tevent_req_nomem(bytes, req)) {
1006                 return tevent_req_post(req, ev);
1007         }
1008
1009         subreq = cli_smb_send(state, ev, cli, SMBsesssetupX, 0, 13, vwv,
1010                               talloc_get_size(bytes), bytes);
1011         if (tevent_req_nomem(subreq, req)) {
1012                 return tevent_req_post(req, ev);
1013         }
1014         tevent_req_set_callback(subreq, cli_session_setup_nt1_done, req);
1015         return req;
1016 }
1017
1018 static void cli_session_setup_nt1_done(struct tevent_req *subreq)
1019 {
1020         struct tevent_req *req = tevent_req_callback_data(
1021                 subreq, struct tevent_req);
1022         struct cli_session_setup_nt1_state *state = tevent_req_data(
1023                 req, struct cli_session_setup_nt1_state);
1024         struct cli_state *cli = state->cli;
1025         uint32_t num_bytes;
1026         uint8_t *in;
1027         char *inbuf;
1028         uint8_t *bytes;
1029         uint8_t *p;
1030         NTSTATUS status;
1031         ssize_t ret;
1032         uint8_t wct;
1033         uint16_t *vwv;
1034
1035         status = cli_smb_recv(subreq, state, &in, 3, &wct, &vwv,
1036                               &num_bytes, &bytes);
1037         TALLOC_FREE(subreq);
1038         if (!NT_STATUS_IS_OK(status)) {
1039                 tevent_req_nterror(req, status);
1040                 return;
1041         }
1042
1043         inbuf = (char *)in;
1044         p = bytes;
1045
1046         cli_state_set_uid(state->cli, SVAL(inbuf, smb_uid));
1047         cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
1048
1049         status = smb_bytes_talloc_string(cli,
1050                                         inbuf,
1051                                         &cli->server_os,
1052                                         p,
1053                                         bytes+num_bytes-p,
1054                                         &ret);
1055         if (!NT_STATUS_IS_OK(status)) {
1056                 tevent_req_nterror(req, status);
1057                 return;
1058         }
1059         p += ret;
1060
1061         status = smb_bytes_talloc_string(cli,
1062                                         inbuf,
1063                                         &cli->server_type,
1064                                         p,
1065                                         bytes+num_bytes-p,
1066                                         &ret);
1067         if (!NT_STATUS_IS_OK(status)) {
1068                 tevent_req_nterror(req, status);
1069                 return;
1070         }
1071         p += ret;
1072
1073         status = smb_bytes_talloc_string(cli,
1074                                         inbuf,
1075                                         &cli->server_domain,
1076                                         p,
1077                                         bytes+num_bytes-p,
1078                                         &ret);
1079         if (!NT_STATUS_IS_OK(status)) {
1080                 tevent_req_nterror(req, status);
1081                 return;
1082         }
1083         p += ret;
1084
1085         status = cli_set_username(cli, state->user);
1086         if (tevent_req_nterror(req, status)) {
1087                 return;
1088         }
1089         if (cli_simple_set_signing(cli, state->session_key, state->response)
1090             && !cli_check_sign_mac(cli, (char *)in, 1)) {
1091                 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1092                 return;
1093         }
1094         if (state->session_key.data) {
1095                 /* Have plaintext orginal */
1096                 cli_set_session_key(cli, state->session_key);
1097         }
1098         tevent_req_done(req);
1099 }
1100
1101 static NTSTATUS cli_session_setup_nt1_recv(struct tevent_req *req)
1102 {
1103         return tevent_req_simple_recv_ntstatus(req);
1104 }
1105
1106 static NTSTATUS cli_session_setup_nt1(struct cli_state *cli, const char *user,
1107                                       const char *pass, size_t passlen,
1108                                       const char *ntpass, size_t ntpasslen,
1109                                       const char *workgroup)
1110 {
1111         TALLOC_CTX *frame = talloc_stackframe();
1112         struct event_context *ev;
1113         struct tevent_req *req;
1114         NTSTATUS status = NT_STATUS_NO_MEMORY;
1115
1116         if (cli_has_async_calls(cli)) {
1117                 /*
1118                  * Can't use sync call while an async call is in flight
1119                  */
1120                 status = NT_STATUS_INVALID_PARAMETER;
1121                 goto fail;
1122         }
1123         ev = event_context_init(frame);
1124         if (ev == NULL) {
1125                 goto fail;
1126         }
1127         req = cli_session_setup_nt1_send(frame, ev, cli, user, pass, passlen,
1128                                          ntpass, ntpasslen, workgroup);
1129         if (req == NULL) {
1130                 goto fail;
1131         }
1132         if (!tevent_req_poll_ntstatus(req, ev, &status)) {
1133                 goto fail;
1134         }
1135         status = cli_session_setup_nt1_recv(req);
1136  fail:
1137         TALLOC_FREE(frame);
1138         return status;
1139 }
1140
1141 /* The following is calculated from :
1142  * (smb_size-4) = 35
1143  * (smb_wcnt * 2) = 24 (smb_wcnt == 12 in cli_session_setup_blob_send() )
1144  * (strlen("Unix") + 1 + strlen("Samba") + 1) * 2 = 22 (unicode strings at
1145  * end of packet.
1146  */
1147
1148 #define BASE_SESSSETUP_BLOB_PACKET_SIZE (35 + 24 + 22)
1149
1150 struct cli_sesssetup_blob_state {
1151         struct tevent_context *ev;
1152         struct cli_state *cli;
1153         DATA_BLOB blob;
1154         uint16_t max_blob_size;
1155         uint16_t vwv[12];
1156         uint8_t *buf;
1157
1158         DATA_BLOB smb2_blob;
1159         struct iovec *recv_iov;
1160
1161         NTSTATUS status;
1162         char *inbuf;
1163         DATA_BLOB ret_blob;
1164 };
1165
1166 static bool cli_sesssetup_blob_next(struct cli_sesssetup_blob_state *state,
1167                                     struct tevent_req **psubreq);
1168 static void cli_sesssetup_blob_done(struct tevent_req *subreq);
1169
1170 static struct tevent_req *cli_sesssetup_blob_send(TALLOC_CTX *mem_ctx,
1171                                                   struct tevent_context *ev,
1172                                                   struct cli_state *cli,
1173                                                   DATA_BLOB blob)
1174 {
1175         struct tevent_req *req, *subreq;
1176         struct cli_sesssetup_blob_state *state;
1177         uint32_t usable_space;
1178
1179         req = tevent_req_create(mem_ctx, &state,
1180                                 struct cli_sesssetup_blob_state);
1181         if (req == NULL) {
1182                 return NULL;
1183         }
1184         state->ev = ev;
1185         state->blob = blob;
1186         state->cli = cli;
1187
1188         if (cli_state_protocol(cli) >= PROTOCOL_SMB2_02) {
1189                 usable_space = UINT16_MAX;
1190         } else {
1191                 usable_space = cli_state_available_size(cli,
1192                                 BASE_SESSSETUP_BLOB_PACKET_SIZE);
1193         }
1194
1195         if (usable_space == 0) {
1196                 DEBUG(1, ("cli_session_setup_blob: cli->max_xmit too small "
1197                           "(not possible to send %u bytes)\n",
1198                           BASE_SESSSETUP_BLOB_PACKET_SIZE + 1));
1199                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1200                 return tevent_req_post(req, ev);
1201         }
1202         state->max_blob_size = MIN(usable_space, 0xFFFF);
1203
1204         if (!cli_sesssetup_blob_next(state, &subreq)) {
1205                 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1206                 return tevent_req_post(req, ev);
1207         }
1208         tevent_req_set_callback(subreq, cli_sesssetup_blob_done, req);
1209         return req;
1210 }
1211
1212 static bool cli_sesssetup_blob_next(struct cli_sesssetup_blob_state *state,
1213                                     struct tevent_req **psubreq)
1214 {
1215         struct tevent_req *subreq;
1216         uint16_t thistime;
1217
1218         thistime = MIN(state->blob.length, state->max_blob_size);
1219
1220         if (cli_state_protocol(state->cli) >= PROTOCOL_SMB2_02) {
1221
1222                 state->smb2_blob.data = state->blob.data;
1223                 state->smb2_blob.length = thistime;
1224
1225                 state->blob.data += thistime;
1226                 state->blob.length -= thistime;
1227
1228                 subreq = smb2cli_session_setup_send(state, state->ev,
1229                                                     state->cli->conn,
1230                                                     state->cli->timeout,
1231                                                     state->cli->smb2.session,
1232                                                     0, /* in_flags */
1233                                                     SMB2_CAP_DFS, /* in_capabilities */
1234                                                     0, /* in_channel */
1235                                                     NULL, /* in_previous_session */
1236                                                     &state->smb2_blob);
1237                 if (subreq == NULL) {
1238                         return false;
1239                 }
1240                 *psubreq = subreq;
1241                 return true;
1242         }
1243
1244         SCVAL(state->vwv+0, 0, 0xFF);
1245         SCVAL(state->vwv+0, 1, 0);
1246         SSVAL(state->vwv+1, 0, 0);
1247         SSVAL(state->vwv+2, 0, CLI_BUFFER_SIZE);
1248         SSVAL(state->vwv+3, 0, 2);
1249         SSVAL(state->vwv+4, 0, 1);
1250         SIVAL(state->vwv+5, 0, 0);
1251
1252         SSVAL(state->vwv+7, 0, thistime);
1253
1254         SSVAL(state->vwv+8, 0, 0);
1255         SSVAL(state->vwv+9, 0, 0);
1256         SIVAL(state->vwv+10, 0,
1257                 cli_session_setup_capabilities(state->cli, CAP_EXTENDED_SECURITY));
1258
1259         state->buf = (uint8_t *)talloc_memdup(state, state->blob.data,
1260                                               thistime);
1261         if (state->buf == NULL) {
1262                 return false;
1263         }
1264         state->blob.data += thistime;
1265         state->blob.length -= thistime;
1266
1267         state->buf = smb_bytes_push_str(state->buf, cli_ucs2(state->cli),
1268                                         "Unix", 5, NULL);
1269         state->buf = smb_bytes_push_str(state->buf, cli_ucs2(state->cli),
1270                                         "Samba", 6, NULL);
1271         if (state->buf == NULL) {
1272                 return false;
1273         }
1274         subreq = cli_smb_send(state, state->ev, state->cli, SMBsesssetupX, 0,
1275                               12, state->vwv,
1276                               talloc_get_size(state->buf), state->buf);
1277         if (subreq == NULL) {
1278                 return false;
1279         }
1280         *psubreq = subreq;
1281         return true;
1282 }
1283
1284 static void cli_sesssetup_blob_done(struct tevent_req *subreq)
1285 {
1286         struct tevent_req *req = tevent_req_callback_data(
1287                 subreq, struct tevent_req);
1288         struct cli_sesssetup_blob_state *state = tevent_req_data(
1289                 req, struct cli_sesssetup_blob_state);
1290         struct cli_state *cli = state->cli;
1291         uint8_t wct;
1292         uint16_t *vwv;
1293         uint32_t num_bytes;
1294         uint8_t *bytes;
1295         NTSTATUS status;
1296         uint8_t *p;
1297         uint16_t blob_length;
1298         uint8_t *inbuf;
1299         ssize_t ret;
1300
1301         if (cli_state_protocol(state->cli) >= PROTOCOL_SMB2_02) {
1302                 status = smb2cli_session_setup_recv(subreq, state,
1303                                                     &state->recv_iov,
1304                                                     &state->ret_blob);
1305         } else {
1306                 status = cli_smb_recv(subreq, state, &inbuf, 4, &wct, &vwv,
1307                                       &num_bytes, &bytes);
1308                 TALLOC_FREE(state->buf);
1309         }
1310         TALLOC_FREE(subreq);
1311         if (!NT_STATUS_IS_OK(status)
1312             && !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1313                 tevent_req_nterror(req, status);
1314                 return;
1315         }
1316
1317         state->status = status;
1318
1319         if (cli_state_protocol(state->cli) >= PROTOCOL_SMB2_02) {
1320                 goto next;
1321         }
1322
1323         state->inbuf = (char *)inbuf;
1324         cli_state_set_uid(state->cli, SVAL(inbuf, smb_uid));
1325         cli->is_guestlogin = ((SVAL(vwv+2, 0) & 1) != 0);
1326
1327         blob_length = SVAL(vwv+3, 0);
1328         if (blob_length > num_bytes) {
1329                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1330                 return;
1331         }
1332         state->ret_blob = data_blob_const(bytes, blob_length);
1333
1334         p = bytes + blob_length;
1335
1336         status = smb_bytes_talloc_string(cli,
1337                                         (char *)inbuf,
1338                                         &cli->server_os,
1339                                         p,
1340                                         bytes+num_bytes-p,
1341                                         &ret);
1342
1343         if (!NT_STATUS_IS_OK(status)) {
1344                 tevent_req_nterror(req, status);
1345                 return;
1346         }
1347         p += ret;
1348
1349         status = smb_bytes_talloc_string(cli,
1350                                         (char *)inbuf,
1351                                         &cli->server_type,
1352                                         p,
1353                                         bytes+num_bytes-p,
1354                                         &ret);
1355
1356         if (!NT_STATUS_IS_OK(status)) {
1357                 tevent_req_nterror(req, status);
1358                 return;
1359         }
1360         p += ret;
1361
1362         status = smb_bytes_talloc_string(cli,
1363                                         (char *)inbuf,
1364                                         &cli->server_domain,
1365                                         p,
1366                                         bytes+num_bytes-p,
1367                                         &ret);
1368
1369         if (!NT_STATUS_IS_OK(status)) {
1370                 tevent_req_nterror(req, status);
1371                 return;
1372         }
1373         p += ret;
1374
1375 next:
1376         if (state->blob.length != 0) {
1377                 /*
1378                  * More to send
1379                  */
1380                 if (!cli_sesssetup_blob_next(state, &subreq)) {
1381                         tevent_req_oom(req);
1382                         return;
1383                 }
1384                 tevent_req_set_callback(subreq, cli_sesssetup_blob_done, req);
1385                 return;
1386         }
1387         tevent_req_done(req);
1388 }
1389
1390 static NTSTATUS cli_sesssetup_blob_recv(struct tevent_req *req,
1391                                         TALLOC_CTX *mem_ctx,
1392                                         DATA_BLOB *pblob,
1393                                         char **pinbuf,
1394                                         struct iovec **precv_iov)
1395 {
1396         struct cli_sesssetup_blob_state *state = tevent_req_data(
1397                 req, struct cli_sesssetup_blob_state);
1398         NTSTATUS status;
1399         char *inbuf;
1400         struct iovec *recv_iov;
1401
1402         if (tevent_req_is_nterror(req, &status)) {
1403                 TALLOC_FREE(state->cli->smb2.session);
1404                 cli_state_set_uid(state->cli, UID_FIELD_INVALID);
1405                 return status;
1406         }
1407
1408         inbuf = talloc_move(mem_ctx, &state->inbuf);
1409         recv_iov = talloc_move(mem_ctx, &state->recv_iov);
1410         if (pblob != NULL) {
1411                 *pblob = state->ret_blob;
1412         }
1413         if (pinbuf != NULL) {
1414                 *pinbuf = inbuf;
1415         }
1416         if (precv_iov != NULL) {
1417                 *precv_iov = recv_iov;
1418         }
1419         /* could be NT_STATUS_MORE_PROCESSING_REQUIRED */
1420         return state->status;
1421 }
1422
1423 #ifdef HAVE_KRB5
1424
1425 /****************************************************************************
1426  Use in-memory credentials cache
1427 ****************************************************************************/
1428
1429 static void use_in_memory_ccache(void) {
1430         setenv(KRB5_ENV_CCNAME, "MEMORY:cliconnect", 1);
1431 }
1432
1433 /****************************************************************************
1434  Do a spnego/kerberos encrypted session setup.
1435 ****************************************************************************/
1436
1437 struct cli_session_setup_kerberos_state {
1438         struct cli_state *cli;
1439         DATA_BLOB negTokenTarg;
1440         DATA_BLOB session_key_krb5;
1441         ADS_STATUS ads_status;
1442 };
1443
1444 static void cli_session_setup_kerberos_done(struct tevent_req *subreq);
1445
1446 static struct tevent_req *cli_session_setup_kerberos_send(
1447         TALLOC_CTX *mem_ctx, struct tevent_context *ev, struct cli_state *cli,
1448         const char *principal)
1449 {
1450         struct tevent_req *req, *subreq;
1451         struct cli_session_setup_kerberos_state *state;
1452         int rc;
1453
1454         DEBUG(2,("Doing kerberos session setup\n"));
1455
1456         req = tevent_req_create(mem_ctx, &state,
1457                                 struct cli_session_setup_kerberos_state);
1458         if (req == NULL) {
1459                 return NULL;
1460         }
1461         state->cli = cli;
1462         state->ads_status = ADS_SUCCESS;
1463
1464         /*
1465          * Ok, this is cheating: spnego_gen_krb5_negTokenInit can block if
1466          * we have to acquire a ticket. To be fixed later :-)
1467          */
1468         rc = spnego_gen_krb5_negTokenInit(state, principal, 0, &state->negTokenTarg,
1469                                      &state->session_key_krb5, 0, NULL);
1470         if (rc) {
1471                 DEBUG(1, ("cli_session_setup_kerberos: "
1472                           "spnego_gen_krb5_negTokenInit failed: %s\n",
1473                           error_message(rc)));
1474                 state->ads_status = ADS_ERROR_KRB5(rc);
1475                 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
1476                 return tevent_req_post(req, ev);
1477         }
1478
1479 #if 0
1480         file_save("negTokenTarg.dat", state->negTokenTarg.data,
1481                   state->negTokenTarg.length);
1482 #endif
1483
1484         if (cli_state_protocol(cli) >= PROTOCOL_SMB2_02) {
1485                 state->cli->smb2.session = smbXcli_session_create(cli,
1486                                                                   cli->conn);
1487                 if (tevent_req_nomem(state->cli->smb2.session, req)) {
1488                         return tevent_req_post(req, ev);
1489                 }
1490         }
1491
1492         subreq = cli_sesssetup_blob_send(state, ev, cli, state->negTokenTarg);
1493         if (tevent_req_nomem(subreq, req)) {
1494                 return tevent_req_post(req, ev);
1495         }
1496         tevent_req_set_callback(subreq, cli_session_setup_kerberos_done, req);
1497         return req;
1498 }
1499
1500 static void cli_session_setup_kerberos_done(struct tevent_req *subreq)
1501 {
1502         struct tevent_req *req = tevent_req_callback_data(
1503                 subreq, struct tevent_req);
1504         struct cli_session_setup_kerberos_state *state = tevent_req_data(
1505                 req, struct cli_session_setup_kerberos_state);
1506         char *inbuf = NULL;
1507         struct iovec *recv_iov = NULL;
1508         NTSTATUS status;
1509
1510         status = cli_sesssetup_blob_recv(subreq, state,
1511                                          NULL, &inbuf, &recv_iov);
1512         TALLOC_FREE(subreq);
1513         if (!NT_STATUS_IS_OK(status)) {
1514                 tevent_req_nterror(req, status);
1515                 return;
1516         }
1517
1518         cli_set_session_key(state->cli, state->session_key_krb5);
1519
1520         if (cli_state_protocol(state->cli) >= PROTOCOL_SMB2_02) {
1521                 struct smbXcli_session *session = state->cli->smb2.session;
1522                 status = smb2cli_session_update_session_key(session,
1523                                                 state->session_key_krb5,
1524                                                 recv_iov);
1525                 if (tevent_req_nterror(req, status)) {
1526                         return;
1527                 }
1528         } else {
1529                 if (cli_simple_set_signing(state->cli, state->session_key_krb5,
1530                                            data_blob_null)
1531                     && !cli_check_sign_mac(state->cli, inbuf, 1)) {
1532                         tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1533                         return;
1534                 }
1535         }
1536
1537         tevent_req_done(req);
1538 }
1539
1540 static ADS_STATUS cli_session_setup_kerberos_recv(struct tevent_req *req)
1541 {
1542         struct cli_session_setup_kerberos_state *state = tevent_req_data(
1543                 req, struct cli_session_setup_kerberos_state);
1544         NTSTATUS status;
1545
1546         if (tevent_req_is_nterror(req, &status)) {
1547                 return ADS_ERROR_NT(status);
1548         }
1549         return state->ads_status;
1550 }
1551
1552 static ADS_STATUS cli_session_setup_kerberos(struct cli_state *cli,
1553                                              const char *principal)
1554 {
1555         struct tevent_context *ev;
1556         struct tevent_req *req;
1557         ADS_STATUS status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1558
1559         if (cli_has_async_calls(cli)) {
1560                 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1561         }
1562         ev = tevent_context_init(talloc_tos());
1563         if (ev == NULL) {
1564                 goto fail;
1565         }
1566         req = cli_session_setup_kerberos_send(ev, ev, cli, principal);
1567         if (req == NULL) {
1568                 goto fail;
1569         }
1570         if (!tevent_req_poll(req, ev)) {
1571                 status = ADS_ERROR_SYSTEM(errno);
1572                 goto fail;
1573         }
1574         status = cli_session_setup_kerberos_recv(req);
1575 fail:
1576         TALLOC_FREE(ev);
1577         return status;
1578 }
1579 #endif  /* HAVE_KRB5 */
1580
1581 /****************************************************************************
1582  Do a spnego/NTLMSSP encrypted session setup.
1583 ****************************************************************************/
1584
1585 struct cli_session_setup_ntlmssp_state {
1586         struct tevent_context *ev;
1587         struct cli_state *cli;
1588         struct ntlmssp_state *ntlmssp_state;
1589         int turn;
1590         DATA_BLOB blob_out;
1591 };
1592
1593 static int cli_session_setup_ntlmssp_state_destructor(
1594         struct cli_session_setup_ntlmssp_state *state)
1595 {
1596         if (state->ntlmssp_state != NULL) {
1597                 TALLOC_FREE(state->ntlmssp_state);
1598         }
1599         return 0;
1600 }
1601
1602 static void cli_session_setup_ntlmssp_done(struct tevent_req *req);
1603
1604 static struct tevent_req *cli_session_setup_ntlmssp_send(
1605         TALLOC_CTX *mem_ctx, struct tevent_context *ev, struct cli_state *cli,
1606         const char *user, const char *pass, const char *domain)
1607 {
1608         struct tevent_req *req, *subreq;
1609         struct cli_session_setup_ntlmssp_state *state;
1610         NTSTATUS status;
1611         DATA_BLOB blob_out;
1612         const char *OIDs_ntlm[] = {OID_NTLMSSP, NULL};
1613
1614         req = tevent_req_create(mem_ctx, &state,
1615                                 struct cli_session_setup_ntlmssp_state);
1616         if (req == NULL) {
1617                 return NULL;
1618         }
1619         state->ev = ev;
1620         state->cli = cli;
1621         state->turn = 1;
1622
1623         state->ntlmssp_state = NULL;
1624         talloc_set_destructor(
1625                 state, cli_session_setup_ntlmssp_state_destructor);
1626
1627         status = ntlmssp_client_start(state,
1628                                       lp_netbios_name(),
1629                                       lp_workgroup(),
1630                                       lp_client_ntlmv2_auth(),
1631                                       &state->ntlmssp_state);
1632         if (!NT_STATUS_IS_OK(status)) {
1633                 goto fail;
1634         }
1635         ntlmssp_want_feature(state->ntlmssp_state,
1636                              NTLMSSP_FEATURE_SESSION_KEY);
1637         if (cli->use_ccache) {
1638                 ntlmssp_want_feature(state->ntlmssp_state,
1639                                      NTLMSSP_FEATURE_CCACHE);
1640         }
1641         status = ntlmssp_set_username(state->ntlmssp_state, user);
1642         if (!NT_STATUS_IS_OK(status)) {
1643                 goto fail;
1644         }
1645         status = ntlmssp_set_domain(state->ntlmssp_state, domain);
1646         if (!NT_STATUS_IS_OK(status)) {
1647                 goto fail;
1648         }
1649         status = ntlmssp_set_password(state->ntlmssp_state, pass);
1650         if (!NT_STATUS_IS_OK(status)) {
1651                 goto fail;
1652         }
1653         status = ntlmssp_update(state->ntlmssp_state, data_blob_null,
1654                                 &blob_out);
1655         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1656                 goto fail;
1657         }
1658
1659         state->blob_out = spnego_gen_negTokenInit(state, OIDs_ntlm, &blob_out, NULL);
1660         data_blob_free(&blob_out);
1661
1662         if (cli_state_protocol(cli) >= PROTOCOL_SMB2_02) {
1663                 state->cli->smb2.session = smbXcli_session_create(cli,
1664                                                                   cli->conn);
1665                 if (tevent_req_nomem(state->cli->smb2.session, req)) {
1666                         return tevent_req_post(req, ev);
1667                 }
1668         }
1669
1670         subreq = cli_sesssetup_blob_send(state, ev, cli, state->blob_out);
1671         if (tevent_req_nomem(subreq, req)) {
1672                 return tevent_req_post(req, ev);
1673         }
1674         tevent_req_set_callback(subreq, cli_session_setup_ntlmssp_done, req);
1675         return req;
1676 fail:
1677         tevent_req_nterror(req, status);
1678         return tevent_req_post(req, ev);
1679 }
1680
1681 static void cli_session_setup_ntlmssp_done(struct tevent_req *subreq)
1682 {
1683         struct tevent_req *req = tevent_req_callback_data(
1684                 subreq, struct tevent_req);
1685         struct cli_session_setup_ntlmssp_state *state = tevent_req_data(
1686                 req, struct cli_session_setup_ntlmssp_state);
1687         DATA_BLOB blob_in, msg_in, blob_out;
1688         char *inbuf = NULL;
1689         struct iovec *recv_iov = NULL;
1690         bool parse_ret;
1691         NTSTATUS status;
1692
1693         status = cli_sesssetup_blob_recv(subreq, talloc_tos(), &blob_in,
1694                                          &inbuf, &recv_iov);
1695         TALLOC_FREE(subreq);
1696         data_blob_free(&state->blob_out);
1697
1698         if (NT_STATUS_IS_OK(status)) {
1699                 if (state->cli->server_domain[0] == '\0') {
1700                         TALLOC_FREE(state->cli->server_domain);
1701                         state->cli->server_domain = talloc_strdup(state->cli,
1702                                                 state->ntlmssp_state->server.netbios_domain);
1703                         if (state->cli->server_domain == NULL) {
1704                                 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1705                                 return;
1706                         }
1707                 }
1708                 cli_set_session_key(
1709                         state->cli, state->ntlmssp_state->session_key);
1710
1711                 if (cli_state_protocol(state->cli) >= PROTOCOL_SMB2_02) {
1712                         struct smbXcli_session *session = state->cli->smb2.session;
1713                         status = smb2cli_session_update_session_key(session,
1714                                                 state->ntlmssp_state->session_key,
1715                                                 recv_iov);
1716                         if (tevent_req_nterror(req, status)) {
1717                                 return;
1718                         }
1719                 } else {
1720                         if (cli_simple_set_signing(
1721                                     state->cli, state->ntlmssp_state->session_key,
1722                                     data_blob_null)
1723                             && !cli_check_sign_mac(state->cli, inbuf, 1)) {
1724                                 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1725                                 return;
1726                         }
1727                 }
1728                 TALLOC_FREE(state->ntlmssp_state);
1729                 tevent_req_done(req);
1730                 return;
1731         }
1732         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1733                 tevent_req_nterror(req, status);
1734                 return;
1735         }
1736
1737         if (blob_in.length == 0) {
1738                 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
1739                 return;
1740         }
1741
1742         if ((state->turn == 1)
1743             && NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1744                 DATA_BLOB tmp_blob = data_blob_null;
1745                 /* the server might give us back two challenges */
1746                 parse_ret = spnego_parse_challenge(state, blob_in, &msg_in,
1747                                                    &tmp_blob);
1748                 data_blob_free(&tmp_blob);
1749         } else {
1750                 parse_ret = spnego_parse_auth_response(state, blob_in, status,
1751                                                        OID_NTLMSSP, &msg_in);
1752         }
1753         state->turn += 1;
1754
1755         if (!parse_ret) {
1756                 DEBUG(3,("Failed to parse auth response\n"));
1757                 if (NT_STATUS_IS_OK(status)
1758                     || NT_STATUS_EQUAL(status,
1759                                        NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1760                         tevent_req_nterror(
1761                                 req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1762                         return;
1763                 }
1764         }
1765
1766         status = ntlmssp_update(state->ntlmssp_state, msg_in, &blob_out);
1767
1768         if (!NT_STATUS_IS_OK(status)
1769             && !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1770                 TALLOC_FREE(state->ntlmssp_state);
1771                 tevent_req_nterror(req, status);
1772                 return;
1773         }
1774
1775         state->blob_out = spnego_gen_auth(state, blob_out);
1776         if (tevent_req_nomem(state->blob_out.data, req)) {
1777                 return;
1778         }
1779
1780         subreq = cli_sesssetup_blob_send(state, state->ev, state->cli,
1781                                          state->blob_out);
1782         if (tevent_req_nomem(subreq, req)) {
1783                 return;
1784         }
1785         tevent_req_set_callback(subreq, cli_session_setup_ntlmssp_done, req);
1786 }
1787
1788 static NTSTATUS cli_session_setup_ntlmssp_recv(struct tevent_req *req)
1789 {
1790         struct cli_session_setup_ntlmssp_state *state = tevent_req_data(
1791                 req, struct cli_session_setup_ntlmssp_state);
1792         NTSTATUS status;
1793
1794         if (tevent_req_is_nterror(req, &status)) {
1795                 cli_state_set_uid(state->cli, UID_FIELD_INVALID);
1796                 return status;
1797         }
1798         return NT_STATUS_OK;
1799 }
1800
1801 static NTSTATUS cli_session_setup_ntlmssp(struct cli_state *cli,
1802                                           const char *user,
1803                                           const char *pass,
1804                                           const char *domain)
1805 {
1806         struct tevent_context *ev;
1807         struct tevent_req *req;
1808         NTSTATUS status = NT_STATUS_NO_MEMORY;
1809
1810         if (cli_has_async_calls(cli)) {
1811                 return NT_STATUS_INVALID_PARAMETER;
1812         }
1813         ev = tevent_context_init(talloc_tos());
1814         if (ev == NULL) {
1815                 goto fail;
1816         }
1817         req = cli_session_setup_ntlmssp_send(ev, ev, cli, user, pass, domain);
1818         if (req == NULL) {
1819                 goto fail;
1820         }
1821         if (!tevent_req_poll_ntstatus(req, ev, &status)) {
1822                 goto fail;
1823         }
1824         status = cli_session_setup_ntlmssp_recv(req);
1825 fail:
1826         TALLOC_FREE(ev);
1827         return status;
1828 }
1829
1830 /****************************************************************************
1831  Do a spnego encrypted session setup.
1832
1833  user_domain: The shortname of the domain the user/machine is a member of.
1834  dest_realm: The realm we're connecting to, if NULL we use our default realm.
1835 ****************************************************************************/
1836
1837 static ADS_STATUS cli_session_setup_spnego(struct cli_state *cli,
1838                               const char *user,
1839                               const char *pass,
1840                               const char *user_domain,
1841                               const char * dest_realm)
1842 {
1843         char *principal = NULL;
1844         char *OIDs[ASN1_MAX_OIDS];
1845         int i;
1846         const DATA_BLOB *server_blob;
1847         DATA_BLOB blob = data_blob_null;
1848         const char *p = NULL;
1849         char *account = NULL;
1850         NTSTATUS status;
1851
1852         server_blob = cli_state_server_gss_blob(cli);
1853         if (server_blob) {
1854                 blob = data_blob(server_blob->data, server_blob->length);
1855         }
1856
1857         DEBUG(3,("Doing spnego session setup (blob length=%lu)\n", (unsigned long)blob.length));
1858
1859         /* the server might not even do spnego */
1860         if (blob.length == 0) {
1861                 DEBUG(3,("server didn't supply a full spnego negprot\n"));
1862                 goto ntlmssp;
1863         }
1864
1865 #if 0
1866         file_save("negprot.dat", cli->secblob.data, cli->secblob.length);
1867 #endif
1868
1869         /* The server sent us the first part of the SPNEGO exchange in the
1870          * negprot reply. It is WRONG to depend on the principal sent in the
1871          * negprot reply, but right now we do it. If we don't receive one,
1872          * we try to best guess, then fall back to NTLM.  */
1873         if (!spnego_parse_negTokenInit(talloc_tos(), blob, OIDs, &principal, NULL) ||
1874                         OIDs[0] == NULL) {
1875                 data_blob_free(&blob);
1876                 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1877         }
1878         data_blob_free(&blob);
1879
1880         /* make sure the server understands kerberos */
1881         for (i=0;OIDs[i];i++) {
1882                 if (i == 0)
1883                         DEBUG(3,("got OID=%s\n", OIDs[i]));
1884                 else
1885                         DEBUGADD(3,("got OID=%s\n", OIDs[i]));
1886                 if (strcmp(OIDs[i], OID_KERBEROS5_OLD) == 0 ||
1887                     strcmp(OIDs[i], OID_KERBEROS5) == 0) {
1888                         cli->got_kerberos_mechanism = True;
1889                 }
1890                 talloc_free(OIDs[i]);
1891         }
1892
1893         DEBUG(3,("got principal=%s\n", principal ? principal : "<null>"));
1894
1895         status = cli_set_username(cli, user);
1896         if (!NT_STATUS_IS_OK(status)) {
1897                 TALLOC_FREE(principal);
1898                 return ADS_ERROR_NT(status);
1899         }
1900
1901 #ifdef HAVE_KRB5
1902         /* If password is set we reauthenticate to kerberos server
1903          * and do not store results */
1904
1905         if (user && *user && cli->got_kerberos_mechanism && cli->use_kerberos) {
1906                 ADS_STATUS rc;
1907                 const char *remote_name = cli_state_remote_name(cli);
1908
1909                 if (pass && *pass) {
1910                         int ret;
1911
1912                         use_in_memory_ccache();
1913                         ret = kerberos_kinit_password(user, pass, 0 /* no time correction for now */, NULL);
1914
1915                         if (ret){
1916                                 TALLOC_FREE(principal);
1917                                 DEBUG(0, ("Kinit failed: %s\n", error_message(ret)));
1918                                 if (cli->fallback_after_kerberos)
1919                                         goto ntlmssp;
1920                                 return ADS_ERROR_KRB5(ret);
1921                         }
1922                 }
1923
1924                 /* We may not be allowed to use the server-supplied SPNEGO principal, or it may not have been supplied to us
1925                  */
1926                 if (!lp_client_use_spnego_principal() || strequal(principal, ADS_IGNORE_PRINCIPAL)) {
1927                         TALLOC_FREE(principal);
1928                 }
1929
1930                 if (principal == NULL &&
1931                         !is_ipaddress(remote_name) &&
1932                         !strequal(STAR_SMBSERVER,
1933                                   remote_name)) {
1934                         DEBUG(3,("cli_session_setup_spnego: using target "
1935                                  "hostname not SPNEGO principal\n"));
1936
1937                         if (dest_realm) {
1938                                 char *realm = strupper_talloc(talloc_tos(), dest_realm);
1939                                 if (realm) {
1940                                         principal = talloc_asprintf(talloc_tos(),
1941                                                                     "cifs/%s@%s",
1942                                                                     remote_name,
1943                                                                     realm);
1944                                         TALLOC_FREE(realm);
1945                                 }
1946                         } else {
1947                                 principal = kerberos_get_principal_from_service_hostname(talloc_tos(),
1948                                                                                          "cifs",
1949                                                                                          remote_name);
1950                         }
1951
1952                         if (!principal) {
1953                                 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1954                         }
1955                         DEBUG(3,("cli_session_setup_spnego: guessed "
1956                                 "server principal=%s\n",
1957                                 principal ? principal : "<null>"));
1958                 }
1959
1960                 if (principal) {
1961                         rc = cli_session_setup_kerberos(cli, principal);
1962                         if (ADS_ERR_OK(rc) || !cli->fallback_after_kerberos) {
1963                                 TALLOC_FREE(principal);
1964                                 return rc;
1965                         }
1966                 }
1967         }
1968 #endif
1969
1970         TALLOC_FREE(principal);
1971
1972 ntlmssp:
1973
1974         account = talloc_strdup(talloc_tos(), user);
1975         if (!account) {
1976                 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1977         }
1978
1979         /* when falling back to ntlmssp while authenticating with a machine
1980          * account strip off the realm - gd */
1981
1982         if ((p = strchr_m(user, '@')) != NULL) {
1983                 account[PTR_DIFF(p,user)] = '\0';
1984         }
1985
1986         return ADS_ERROR_NT(cli_session_setup_ntlmssp(cli, account, pass, user_domain));
1987 }
1988
1989 /****************************************************************************
1990  Send a session setup. The username and workgroup is in UNIX character
1991  format and must be converted to DOS codepage format before sending. If the
1992  password is in plaintext, the same should be done.
1993 ****************************************************************************/
1994
1995 NTSTATUS cli_session_setup(struct cli_state *cli,
1996                            const char *user,
1997                            const char *pass, int passlen,
1998                            const char *ntpass, int ntpasslen,
1999                            const char *workgroup)
2000 {
2001         char *p;
2002         char *user2;
2003         uint16_t sec_mode = cli_state_security_mode(cli);
2004
2005         if (user) {
2006                 user2 = talloc_strdup(talloc_tos(), user);
2007         } else {
2008                 user2 = talloc_strdup(talloc_tos(), "");
2009         }
2010         if (user2 == NULL) {
2011                 return NT_STATUS_NO_MEMORY;
2012         }
2013
2014         if (!workgroup) {
2015                 workgroup = "";
2016         }
2017
2018         /* allow for workgroups as part of the username */
2019         if ((p=strchr_m(user2,'\\')) || (p=strchr_m(user2,'/')) ||
2020             (p=strchr_m(user2,*lp_winbind_separator()))) {
2021                 *p = 0;
2022                 user = p+1;
2023                 strupper_m(user2);
2024                 workgroup = user2;
2025         }
2026
2027         if (cli_state_protocol(cli) < PROTOCOL_LANMAN1) {
2028                 return NT_STATUS_OK;
2029         }
2030
2031         /* now work out what sort of session setup we are going to
2032            do. I have split this into separate functions to make the
2033            flow a bit easier to understand (tridge) */
2034
2035         /* if its an older server then we have to use the older request format */
2036
2037         if (cli_state_protocol(cli) < PROTOCOL_NT1) {
2038                 if (!lp_client_lanman_auth() && passlen != 24 && (*pass)) {
2039                         DEBUG(1, ("Server requested LM password but 'client lanman auth = no'"
2040                                   " or 'client ntlmv2 auth = yes'\n"));
2041                         return NT_STATUS_ACCESS_DENIED;
2042                 }
2043
2044                 if ((sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0 &&
2045                     !lp_client_plaintext_auth() && (*pass)) {
2046                         DEBUG(1, ("Server requested LM password but 'client plaintext auth = no'"
2047                                   " or 'client ntlmv2 auth = yes'\n"));
2048                         return NT_STATUS_ACCESS_DENIED;
2049                 }
2050
2051                 return cli_session_setup_lanman2(cli, user, pass, passlen,
2052                                                  workgroup);
2053         }
2054
2055         if (cli_state_protocol(cli) >= PROTOCOL_SMB2_02) {
2056                 const char *remote_realm = cli_state_remote_realm(cli);
2057                 ADS_STATUS status = cli_session_setup_spnego(cli, user, pass,
2058                                                              workgroup,
2059                                                              remote_realm);
2060                 if (!ADS_ERR_OK(status)) {
2061                         DEBUG(3, ("SMB2-SPNEGO login failed: %s\n", ads_errstr(status)));
2062                         return ads_ntstatus(status);
2063                 }
2064                 return NT_STATUS_OK;
2065         }
2066
2067         /* if no user is supplied then we have to do an anonymous connection.
2068            passwords are ignored */
2069
2070         if (!user || !*user)
2071                 return cli_session_setup_guest(cli);
2072
2073         /* if the server is share level then send a plaintext null
2074            password at this point. The password is sent in the tree
2075            connect */
2076
2077         if ((sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) == 0)
2078                 return cli_session_setup_plain(cli, user, "", workgroup);
2079
2080         /* if the server doesn't support encryption then we have to use
2081            plaintext. The second password is ignored */
2082
2083         if ((sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0) {
2084                 if (!lp_client_plaintext_auth() && (*pass)) {
2085                         DEBUG(1, ("Server requested LM password but 'client plaintext auth = no'"
2086                                   " or 'client ntlmv2 auth = yes'\n"));
2087                         return NT_STATUS_ACCESS_DENIED;
2088                 }
2089                 return cli_session_setup_plain(cli, user, pass, workgroup);
2090         }
2091
2092         /* if the server supports extended security then use SPNEGO */
2093
2094         if (cli_state_capabilities(cli) & CAP_EXTENDED_SECURITY) {
2095                 const char *remote_realm = cli_state_remote_realm(cli);
2096                 ADS_STATUS status = cli_session_setup_spnego(cli, user, pass,
2097                                                              workgroup,
2098                                                              remote_realm);
2099                 if (!ADS_ERR_OK(status)) {
2100                         DEBUG(3, ("SPNEGO login failed: %s\n", ads_errstr(status)));
2101                         return ads_ntstatus(status);
2102                 }
2103         } else {
2104                 NTSTATUS status;
2105
2106                 /* otherwise do a NT1 style session setup */
2107                 status = cli_session_setup_nt1(cli, user, pass, passlen,
2108                                                ntpass, ntpasslen, workgroup);
2109                 if (!NT_STATUS_IS_OK(status)) {
2110                         DEBUG(3,("cli_session_setup: NT1 session setup "
2111                                  "failed: %s\n", nt_errstr(status)));
2112                         return status;
2113                 }
2114         }
2115
2116         return NT_STATUS_OK;
2117 }
2118
2119 /****************************************************************************
2120  Send a uloggoff.
2121 *****************************************************************************/
2122
2123 struct cli_ulogoff_state {
2124         struct cli_state *cli;
2125         uint16_t vwv[3];
2126 };
2127
2128 static void cli_ulogoff_done(struct tevent_req *subreq);
2129
2130 struct tevent_req *cli_ulogoff_send(TALLOC_CTX *mem_ctx,
2131                                     struct tevent_context *ev,
2132                                     struct cli_state *cli)
2133 {
2134         struct tevent_req *req, *subreq;
2135         struct cli_ulogoff_state *state;
2136
2137         req = tevent_req_create(mem_ctx, &state, struct cli_ulogoff_state);
2138         if (req == NULL) {
2139                 return NULL;
2140         }
2141         state->cli = cli;
2142
2143         SCVAL(state->vwv+0, 0, 0xFF);
2144         SCVAL(state->vwv+1, 0, 0);
2145         SSVAL(state->vwv+2, 0, 0);
2146
2147         subreq = cli_smb_send(state, ev, cli, SMBulogoffX, 0, 2, state->vwv,
2148                               0, NULL);
2149         if (tevent_req_nomem(subreq, req)) {
2150                 return tevent_req_post(req, ev);
2151         }
2152         tevent_req_set_callback(subreq, cli_ulogoff_done, req);
2153         return req;
2154 }
2155
2156 static void cli_ulogoff_done(struct tevent_req *subreq)
2157 {
2158         struct tevent_req *req = tevent_req_callback_data(
2159                 subreq, struct tevent_req);
2160         struct cli_ulogoff_state *state = tevent_req_data(
2161                 req, struct cli_ulogoff_state);
2162         NTSTATUS status;
2163
2164         status = cli_smb_recv(subreq, NULL, NULL, 0, NULL, NULL, NULL, NULL);
2165         if (!NT_STATUS_IS_OK(status)) {
2166                 tevent_req_nterror(req, status);
2167                 return;
2168         }
2169         cli_state_set_uid(state->cli, UID_FIELD_INVALID);
2170         tevent_req_done(req);
2171 }
2172
2173 NTSTATUS cli_ulogoff_recv(struct tevent_req *req)
2174 {
2175         return tevent_req_simple_recv_ntstatus(req);
2176 }
2177
2178 NTSTATUS cli_ulogoff(struct cli_state *cli)
2179 {
2180         struct tevent_context *ev;
2181         struct tevent_req *req;
2182         NTSTATUS status = NT_STATUS_NO_MEMORY;
2183
2184         if (cli_has_async_calls(cli)) {
2185                 return NT_STATUS_INVALID_PARAMETER;
2186         }
2187         ev = tevent_context_init(talloc_tos());
2188         if (ev == NULL) {
2189                 goto fail;
2190         }
2191         req = cli_ulogoff_send(ev, ev, cli);
2192         if (req == NULL) {
2193                 goto fail;
2194         }
2195         if (!tevent_req_poll_ntstatus(req, ev, &status)) {
2196                 goto fail;
2197         }
2198         status = cli_ulogoff_recv(req);
2199 fail:
2200         TALLOC_FREE(ev);
2201         return status;
2202 }
2203
2204 /****************************************************************************
2205  Send a tconX.
2206 ****************************************************************************/
2207
2208 struct cli_tcon_andx_state {
2209         struct cli_state *cli;
2210         uint16_t vwv[4];
2211         struct iovec bytes;
2212 };
2213
2214 static void cli_tcon_andx_done(struct tevent_req *subreq);
2215
2216 struct tevent_req *cli_tcon_andx_create(TALLOC_CTX *mem_ctx,
2217                                         struct event_context *ev,
2218                                         struct cli_state *cli,
2219                                         const char *share, const char *dev,
2220                                         const char *pass, int passlen,
2221                                         struct tevent_req **psmbreq)
2222 {
2223         struct tevent_req *req, *subreq;
2224         struct cli_tcon_andx_state *state;
2225         uint8_t p24[24];
2226         uint16_t *vwv;
2227         char *tmp = NULL;
2228         uint8_t *bytes;
2229         uint16_t sec_mode = cli_state_security_mode(cli);
2230
2231         *psmbreq = NULL;
2232
2233         req = tevent_req_create(mem_ctx, &state, struct cli_tcon_andx_state);
2234         if (req == NULL) {
2235                 return NULL;
2236         }
2237         state->cli = cli;
2238         vwv = state->vwv;
2239
2240         cli->share = talloc_strdup(cli, share);
2241         if (!cli->share) {
2242                 return NULL;
2243         }
2244
2245         /* in user level security don't send a password now */
2246         if (sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) {
2247                 passlen = 1;
2248                 pass = "";
2249         } else if (pass == NULL) {
2250                 DEBUG(1, ("Server not using user level security and no "
2251                           "password supplied.\n"));
2252                 goto access_denied;
2253         }
2254
2255         if ((sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) &&
2256             *pass && passlen != 24) {
2257                 if (!lp_client_lanman_auth()) {
2258                         DEBUG(1, ("Server requested LANMAN password "
2259                                   "(share-level security) but "
2260                                   "'client lanman auth = no' or 'client ntlmv2 auth = yes'\n"));
2261                         goto access_denied;
2262                 }
2263
2264                 /*
2265                  * Non-encrypted passwords - convert to DOS codepage before
2266                  * encryption.
2267                  */
2268                 SMBencrypt(pass, cli_state_server_challenge(cli), p24);
2269                 passlen = 24;
2270                 pass = (const char *)p24;
2271         } else {
2272                 if((sec_mode & (NEGOTIATE_SECURITY_USER_LEVEL
2273                                      |NEGOTIATE_SECURITY_CHALLENGE_RESPONSE))
2274                    == 0) {
2275                         uint8_t *tmp_pass;
2276
2277                         if (!lp_client_plaintext_auth() && (*pass)) {
2278                                 DEBUG(1, ("Server requested plaintext "
2279                                           "password but "
2280                                           "'client lanman auth = no' or 'client ntlmv2 auth = yes'\n"));
2281                                 goto access_denied;
2282                         }
2283
2284                         /*
2285                          * Non-encrypted passwords - convert to DOS codepage
2286                          * before using.
2287                          */
2288                         tmp_pass = talloc_array(talloc_tos(), uint8, 0);
2289                         if (tevent_req_nomem(tmp_pass, req)) {
2290                                 return tevent_req_post(req, ev);
2291                         }
2292                         tmp_pass = trans2_bytes_push_str(tmp_pass,
2293                                                          false, /* always DOS */
2294                                                          pass,
2295                                                          passlen,
2296                                                          NULL);
2297                         if (tevent_req_nomem(tmp_pass, req)) {
2298                                 return tevent_req_post(req, ev);
2299                         }
2300                         pass = (const char *)tmp_pass;
2301                         passlen = talloc_get_size(tmp_pass);
2302                 }
2303         }
2304
2305         SCVAL(vwv+0, 0, 0xFF);
2306         SCVAL(vwv+0, 1, 0);
2307         SSVAL(vwv+1, 0, 0);
2308         SSVAL(vwv+2, 0, TCONX_FLAG_EXTENDED_RESPONSE);
2309         SSVAL(vwv+3, 0, passlen);
2310
2311         if (passlen && pass) {
2312                 bytes = (uint8_t *)talloc_memdup(state, pass, passlen);
2313         } else {
2314                 bytes = talloc_array(state, uint8_t, 0);
2315         }
2316
2317         /*
2318          * Add the sharename
2319          */
2320         tmp = talloc_asprintf_strupper_m(talloc_tos(), "\\\\%s\\%s",
2321                                          cli_state_remote_name(cli), share);
2322         if (tmp == NULL) {
2323                 TALLOC_FREE(req);
2324                 return NULL;
2325         }
2326         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), tmp, strlen(tmp)+1,
2327                                    NULL);
2328         TALLOC_FREE(tmp);
2329
2330         /*
2331          * Add the devicetype
2332          */
2333         tmp = talloc_strdup_upper(talloc_tos(), dev);
2334         if (tmp == NULL) {
2335                 TALLOC_FREE(req);
2336                 return NULL;
2337         }
2338         bytes = smb_bytes_push_str(bytes, false, tmp, strlen(tmp)+1, NULL);
2339         TALLOC_FREE(tmp);
2340
2341         if (bytes == NULL) {
2342                 TALLOC_FREE(req);
2343                 return NULL;
2344         }
2345
2346         state->bytes.iov_base = (void *)bytes;
2347         state->bytes.iov_len = talloc_get_size(bytes);
2348
2349         subreq = cli_smb_req_create(state, ev, cli, SMBtconX, 0, 4, vwv,
2350                                     1, &state->bytes);
2351         if (subreq == NULL) {
2352                 TALLOC_FREE(req);
2353                 return NULL;
2354         }
2355         tevent_req_set_callback(subreq, cli_tcon_andx_done, req);
2356         *psmbreq = subreq;
2357         return req;
2358
2359  access_denied:
2360         tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
2361         return tevent_req_post(req, ev);
2362 }
2363
2364 struct tevent_req *cli_tcon_andx_send(TALLOC_CTX *mem_ctx,
2365                                       struct event_context *ev,
2366                                       struct cli_state *cli,
2367                                       const char *share, const char *dev,
2368                                       const char *pass, int passlen)
2369 {
2370         struct tevent_req *req, *subreq;
2371         NTSTATUS status;
2372
2373         req = cli_tcon_andx_create(mem_ctx, ev, cli, share, dev, pass, passlen,
2374                                    &subreq);
2375         if (req == NULL) {
2376                 return NULL;
2377         }
2378         if (subreq == NULL) {
2379                 return req;
2380         }
2381         status = cli_smb_req_send(subreq);
2382         if (!NT_STATUS_IS_OK(status)) {
2383                 tevent_req_nterror(req, status);
2384                 return tevent_req_post(req, ev);
2385         }
2386         return req;
2387 }
2388
2389 static void cli_tcon_andx_done(struct tevent_req *subreq)
2390 {
2391         struct tevent_req *req = tevent_req_callback_data(
2392                 subreq, struct tevent_req);
2393         struct cli_tcon_andx_state *state = tevent_req_data(
2394                 req, struct cli_tcon_andx_state);
2395         struct cli_state *cli = state->cli;
2396         uint8_t *in;
2397         char *inbuf;
2398         uint8_t wct;
2399         uint16_t *vwv;
2400         uint32_t num_bytes;
2401         uint8_t *bytes;
2402         NTSTATUS status;
2403
2404         status = cli_smb_recv(subreq, state, &in, 0, &wct, &vwv,
2405                               &num_bytes, &bytes);
2406         TALLOC_FREE(subreq);
2407         if (!NT_STATUS_IS_OK(status)) {
2408                 tevent_req_nterror(req, status);
2409                 return;
2410         }
2411
2412         inbuf = (char *)in;
2413
2414         if (num_bytes) {
2415                 if (clistr_pull_talloc(cli,
2416                                 inbuf,
2417                                 SVAL(inbuf, smb_flg2),
2418                                 &cli->dev,
2419                                 bytes,
2420                                 num_bytes,
2421                                 STR_TERMINATE|STR_ASCII) == -1) {
2422                         tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
2423                         return;
2424                 }
2425         } else {
2426                 cli->dev = talloc_strdup(cli, "");
2427                 if (cli->dev == NULL) {
2428                         tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
2429                         return;
2430                 }
2431         }
2432
2433         if ((cli_state_protocol(cli) >= PROTOCOL_NT1) && (num_bytes == 3)) {
2434                 /* almost certainly win95 - enable bug fixes */
2435                 cli->win95 = True;
2436         }
2437
2438         /*
2439          * Make sure that we have the optional support 16-bit field. WCT > 2.
2440          * Avoids issues when connecting to Win9x boxes sharing files
2441          */
2442
2443         cli->dfsroot = false;
2444
2445         if ((wct > 2) && (cli_state_protocol(cli) >= PROTOCOL_LANMAN2)) {
2446                 cli->dfsroot = ((SVAL(vwv+2, 0) & SMB_SHARE_IN_DFS) != 0);
2447         }
2448
2449         cli->smb1.tid = SVAL(inbuf,smb_tid);
2450         tevent_req_done(req);
2451 }
2452
2453 NTSTATUS cli_tcon_andx_recv(struct tevent_req *req)
2454 {
2455         return tevent_req_simple_recv_ntstatus(req);
2456 }
2457
2458 NTSTATUS cli_tcon_andx(struct cli_state *cli, const char *share,
2459                        const char *dev, const char *pass, int passlen)
2460 {
2461         TALLOC_CTX *frame = talloc_stackframe();
2462         struct event_context *ev;
2463         struct tevent_req *req;
2464         NTSTATUS status = NT_STATUS_OK;
2465
2466         if (cli_has_async_calls(cli)) {
2467                 /*
2468                  * Can't use sync call while an async call is in flight
2469                  */
2470                 status = NT_STATUS_INVALID_PARAMETER;
2471                 goto fail;
2472         }
2473
2474         ev = event_context_init(frame);
2475         if (ev == NULL) {
2476                 status = NT_STATUS_NO_MEMORY;
2477                 goto fail;
2478         }
2479
2480         req = cli_tcon_andx_send(frame, ev, cli, share, dev, pass, passlen);
2481         if (req == NULL) {
2482                 status = NT_STATUS_NO_MEMORY;
2483                 goto fail;
2484         }
2485
2486         if (!tevent_req_poll(req, ev)) {
2487                 status = map_nt_error_from_unix(errno);
2488                 goto fail;
2489         }
2490
2491         status = cli_tcon_andx_recv(req);
2492  fail:
2493         TALLOC_FREE(frame);
2494         return status;
2495 }
2496
2497 NTSTATUS cli_tree_connect(struct cli_state *cli, const char *share,
2498                           const char *dev, const char *pass, int passlen)
2499 {
2500         cli->share = talloc_strdup(cli, share);
2501         if (!cli->share) {
2502                 return NT_STATUS_NO_MEMORY;
2503         }
2504
2505         if (cli_state_protocol(cli) >= PROTOCOL_SMB2_02) {
2506                 return smb2cli_tcon(cli, share);
2507         }
2508
2509         return cli_tcon_andx(cli, share, dev, pass, passlen);
2510 }
2511
2512 /****************************************************************************
2513  Send a tree disconnect.
2514 ****************************************************************************/
2515
2516 struct cli_tdis_state {
2517         struct cli_state *cli;
2518 };
2519
2520 static void cli_tdis_done(struct tevent_req *subreq);
2521
2522 struct tevent_req *cli_tdis_send(TALLOC_CTX *mem_ctx,
2523                                  struct tevent_context *ev,
2524                                  struct cli_state *cli)
2525 {
2526         struct tevent_req *req, *subreq;
2527         struct cli_tdis_state *state;
2528
2529         req = tevent_req_create(mem_ctx, &state, struct cli_tdis_state);
2530         if (req == NULL) {
2531                 return NULL;
2532         }
2533         state->cli = cli;
2534
2535         subreq = cli_smb_send(state, ev, cli, SMBtdis, 0, 0, NULL, 0, NULL);
2536         if (tevent_req_nomem(subreq, req)) {
2537                 return tevent_req_post(req, ev);
2538         }
2539         tevent_req_set_callback(subreq, cli_tdis_done, req);
2540         return req;
2541 }
2542
2543 static void cli_tdis_done(struct tevent_req *subreq)
2544 {
2545         struct tevent_req *req = tevent_req_callback_data(
2546                 subreq, struct tevent_req);
2547         struct cli_tdis_state *state = tevent_req_data(
2548                 req, struct cli_tdis_state);
2549         NTSTATUS status;
2550
2551         status = cli_smb_recv(subreq, NULL, NULL, 0, NULL, NULL, NULL, NULL);
2552         TALLOC_FREE(subreq);
2553         if (!NT_STATUS_IS_OK(status)) {
2554                 tevent_req_nterror(req, status);
2555                 return;
2556         }
2557         state->cli->smb1.tid = UINT16_MAX;
2558         tevent_req_done(req);
2559 }
2560
2561 NTSTATUS cli_tdis_recv(struct tevent_req *req)
2562 {
2563         return tevent_req_simple_recv_ntstatus(req);
2564 }
2565
2566 NTSTATUS cli_tdis(struct cli_state *cli)
2567 {
2568         struct tevent_context *ev;
2569         struct tevent_req *req;
2570         NTSTATUS status = NT_STATUS_NO_MEMORY;
2571
2572         if (cli_has_async_calls(cli)) {
2573                 return NT_STATUS_INVALID_PARAMETER;
2574         }
2575         ev = tevent_context_init(talloc_tos());
2576         if (ev == NULL) {
2577                 goto fail;
2578         }
2579         req = cli_tdis_send(ev, ev, cli);
2580         if (req == NULL) {
2581                 goto fail;
2582         }
2583         if (!tevent_req_poll_ntstatus(req, ev, &status)) {
2584                 goto fail;
2585         }
2586         status = cli_tdis_recv(req);
2587 fail:
2588         TALLOC_FREE(ev);
2589         return status;
2590 }
2591
2592 struct tevent_req *cli_negprot_send(TALLOC_CTX *mem_ctx,
2593                                     struct event_context *ev,
2594                                     struct cli_state *cli,
2595                                     enum protocol_types max_protocol)
2596 {
2597         return smbXcli_negprot_send(mem_ctx, ev,
2598                                     cli->conn, cli->timeout,
2599                                     PROTOCOL_CORE, max_protocol);
2600 }
2601
2602 NTSTATUS cli_negprot_recv(struct tevent_req *req)
2603 {
2604         return smbXcli_negprot_recv(req);
2605 }
2606
2607 NTSTATUS cli_negprot(struct cli_state *cli, enum protocol_types max_protocol)
2608 {
2609         return smbXcli_negprot(cli->conn, cli->timeout,
2610                                PROTOCOL_CORE, max_protocol);
2611 }
2612
2613 static NTSTATUS cli_connect_sock(const char *host, int name_type,
2614                                  const struct sockaddr_storage *pss,
2615                                  const char *myname, uint16_t port,
2616                                  int sec_timeout, int *pfd, uint16_t *pport)
2617 {
2618         TALLOC_CTX *frame = talloc_stackframe();
2619         const char *prog;
2620         unsigned int i, num_addrs;
2621         const char **called_names;
2622         const char **calling_names;
2623         int *called_types;
2624         NTSTATUS status;
2625         int fd;
2626
2627         prog = getenv("LIBSMB_PROG");
2628         if (prog != NULL) {
2629                 fd = sock_exec(prog);
2630                 if (fd == -1) {
2631                         return map_nt_error_from_unix(errno);
2632                 }
2633                 port = 0;
2634                 goto done;
2635         }
2636
2637         if ((pss == NULL) || is_zero_addr(pss)) {
2638                 struct sockaddr_storage *addrs;
2639                 status = resolve_name_list(talloc_tos(), host, name_type,
2640                                            &addrs, &num_addrs);
2641                 if (!NT_STATUS_IS_OK(status)) {
2642                         goto fail;
2643                 }
2644                 pss = addrs;
2645         } else {
2646                 num_addrs = 1;
2647         }
2648
2649         called_names = talloc_array(talloc_tos(), const char *, num_addrs);
2650         if (called_names == NULL) {
2651                 status = NT_STATUS_NO_MEMORY;
2652                 goto fail;
2653         }
2654         called_types = talloc_array(talloc_tos(), int, num_addrs);
2655         if (called_types == NULL) {
2656                 status = NT_STATUS_NO_MEMORY;
2657                 goto fail;
2658         }
2659         calling_names = talloc_array(talloc_tos(), const char *, num_addrs);
2660         if (calling_names == NULL) {
2661                 status = NT_STATUS_NO_MEMORY;
2662                 goto fail;
2663         }
2664         for (i=0; i<num_addrs; i++) {
2665                 called_names[i] = host;
2666                 called_types[i] = name_type;
2667                 calling_names[i] = myname;
2668         }
2669         status = smbsock_any_connect(pss, called_names, called_types,
2670                                      calling_names, NULL, num_addrs, port,
2671                                      sec_timeout, &fd, NULL, &port);
2672         if (!NT_STATUS_IS_OK(status)) {
2673                 goto fail;
2674         }
2675         set_socket_options(fd, lp_socket_options());
2676 done:
2677         *pfd = fd;
2678         *pport = port;
2679         status = NT_STATUS_OK;
2680 fail:
2681         TALLOC_FREE(frame);
2682         return status;
2683 }
2684
2685 NTSTATUS cli_connect_nb(const char *host, const struct sockaddr_storage *dest_ss,
2686                         uint16_t port, int name_type, const char *myname,
2687                         int signing_state, int flags, struct cli_state **pcli)
2688 {
2689         TALLOC_CTX *frame = talloc_stackframe();
2690         struct cli_state *cli;
2691         NTSTATUS status = NT_STATUS_NO_MEMORY;
2692         int fd = -1;
2693         char *desthost;
2694         char *p;
2695
2696         desthost = talloc_strdup(talloc_tos(), host);
2697         if (desthost == NULL) {
2698                 goto fail;
2699         }
2700
2701         p = strchr(host, '#');
2702         if (p != NULL) {
2703                 name_type = strtol(p+1, NULL, 16);
2704                 host = talloc_strndup(talloc_tos(), host, p - host);
2705                 if (host == NULL) {
2706                         goto fail;
2707                 }
2708         }
2709
2710         status = cli_connect_sock(host, name_type, dest_ss, myname, port,
2711                                   20, &fd, &port);
2712         if (!NT_STATUS_IS_OK(status)) {
2713                 goto fail;
2714         }
2715
2716         cli = cli_state_create(NULL, fd, desthost, NULL, signing_state, flags);
2717         if (cli == NULL) {
2718                 close(fd);
2719                 fd = -1;
2720                 goto fail;
2721         }
2722
2723         *pcli = cli;
2724         status = NT_STATUS_OK;
2725 fail:
2726         TALLOC_FREE(frame);
2727         return status;
2728 }
2729
2730 /**
2731    establishes a connection to after the negprot.
2732    @param output_cli A fully initialised cli structure, non-null only on success
2733    @param dest_host The netbios name of the remote host
2734    @param dest_ss (optional) The the destination IP, NULL for name based lookup
2735    @param port (optional) The destination port (0 for default)
2736 */
2737 NTSTATUS cli_start_connection(struct cli_state **output_cli,
2738                               const char *my_name,
2739                               const char *dest_host,
2740                               const struct sockaddr_storage *dest_ss, int port,
2741                               int signing_state, int flags)
2742 {
2743         NTSTATUS nt_status;
2744         struct cli_state *cli;
2745
2746         nt_status = cli_connect_nb(dest_host, dest_ss, port, 0x20, my_name,
2747                                    signing_state, flags, &cli);
2748         if (!NT_STATUS_IS_OK(nt_status)) {
2749                 DEBUG(10, ("cli_connect_nb failed: %s\n",
2750                            nt_errstr(nt_status)));
2751                 return nt_status;
2752         }
2753
2754         nt_status = cli_negprot(cli, PROTOCOL_NT1);
2755         if (!NT_STATUS_IS_OK(nt_status)) {
2756                 DEBUG(1, ("failed negprot: %s\n", nt_errstr(nt_status)));
2757                 cli_shutdown(cli);
2758                 return nt_status;
2759         }
2760
2761         *output_cli = cli;
2762         return NT_STATUS_OK;
2763 }
2764
2765
2766 /**
2767    establishes a connection right up to doing tconX, password specified.
2768    @param output_cli A fully initialised cli structure, non-null only on success
2769    @param dest_host The netbios name of the remote host
2770    @param dest_ip (optional) The the destination IP, NULL for name based lookup
2771    @param port (optional) The destination port (0 for default)
2772    @param service (optional) The share to make the connection to.  Should be 'unqualified' in any way.
2773    @param service_type The 'type' of serivice.
2774    @param user Username, unix string
2775    @param domain User's domain
2776    @param password User's password, unencrypted unix string.
2777 */
2778
2779 NTSTATUS cli_full_connection(struct cli_state **output_cli,
2780                              const char *my_name,
2781                              const char *dest_host,
2782                              const struct sockaddr_storage *dest_ss, int port,
2783                              const char *service, const char *service_type,
2784                              const char *user, const char *domain,
2785                              const char *password, int flags,
2786                              int signing_state)
2787 {
2788         NTSTATUS nt_status;
2789         struct cli_state *cli = NULL;
2790         int pw_len = password ? strlen(password)+1 : 0;
2791
2792         *output_cli = NULL;
2793
2794         if (password == NULL) {
2795                 password = "";
2796         }
2797
2798         nt_status = cli_start_connection(&cli, my_name, dest_host,
2799                                          dest_ss, port, signing_state,
2800                                          flags);
2801
2802         if (!NT_STATUS_IS_OK(nt_status)) {
2803                 return nt_status;
2804         }
2805
2806         nt_status = cli_session_setup(cli, user, password, pw_len, password,
2807                                       pw_len, domain);
2808         if (!NT_STATUS_IS_OK(nt_status)) {
2809
2810                 if (!(flags & CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK)) {
2811                         DEBUG(1,("failed session setup with %s\n",
2812                                  nt_errstr(nt_status)));
2813                         cli_shutdown(cli);
2814                         return nt_status;
2815                 }
2816
2817                 nt_status = cli_session_setup(cli, "", "", 0, "", 0, domain);
2818                 if (!NT_STATUS_IS_OK(nt_status)) {
2819                         DEBUG(1,("anonymous failed session setup with %s\n",
2820                                  nt_errstr(nt_status)));
2821                         cli_shutdown(cli);
2822                         return nt_status;
2823                 }
2824         }
2825
2826         if (service) {
2827                 nt_status = cli_tcon_andx(cli, service, service_type, password,
2828                                           pw_len);
2829                 if (!NT_STATUS_IS_OK(nt_status)) {
2830                         DEBUG(1,("failed tcon_X with %s\n", nt_errstr(nt_status)));
2831                         cli_shutdown(cli);
2832                         if (NT_STATUS_IS_OK(nt_status)) {
2833                                 nt_status = NT_STATUS_UNSUCCESSFUL;
2834                         }
2835                         return nt_status;
2836                 }
2837         }
2838
2839         nt_status = cli_init_creds(cli, user, domain, password);
2840         if (!NT_STATUS_IS_OK(nt_status)) {
2841                 cli_shutdown(cli);
2842                 return nt_status;
2843         }
2844
2845         *output_cli = cli;
2846         return NT_STATUS_OK;
2847 }
2848
2849 /****************************************************************************
2850  Send an old style tcon.
2851 ****************************************************************************/
2852 NTSTATUS cli_raw_tcon(struct cli_state *cli,
2853                       const char *service, const char *pass, const char *dev,
2854                       uint16 *max_xmit, uint16 *tid)
2855 {
2856         struct tevent_req *req;
2857         uint16_t *ret_vwv;
2858         uint8_t *bytes;
2859         NTSTATUS status;
2860
2861         if (!lp_client_plaintext_auth() && (*pass)) {
2862                 DEBUG(1, ("Server requested plaintext password but 'client "
2863                           "plaintext auth' is disabled\n"));
2864                 return NT_STATUS_ACCESS_DENIED;
2865         }
2866
2867         bytes = talloc_array(talloc_tos(), uint8_t, 0);
2868         bytes = smb_bytes_push_bytes(bytes, 4, NULL, 0);
2869         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
2870                                    service, strlen(service)+1, NULL);
2871         bytes = smb_bytes_push_bytes(bytes, 4, NULL, 0);
2872         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
2873                                    pass, strlen(pass)+1, NULL);
2874         bytes = smb_bytes_push_bytes(bytes, 4, NULL, 0);
2875         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli),
2876                                    dev, strlen(dev)+1, NULL);
2877
2878         status = cli_smb(talloc_tos(), cli, SMBtcon, 0, 0, NULL,
2879                          talloc_get_size(bytes), bytes, &req,
2880                          2, NULL, &ret_vwv, NULL, NULL);
2881         if (!NT_STATUS_IS_OK(status)) {
2882                 return status;
2883         }
2884
2885         *max_xmit = SVAL(ret_vwv + 0, 0);
2886         *tid = SVAL(ret_vwv + 1, 0);
2887
2888         return NT_STATUS_OK;
2889 }
2890
2891 /* Return a cli_state pointing at the IPC$ share for the given server */
2892
2893 struct cli_state *get_ipc_connect(char *server,
2894                                 struct sockaddr_storage *server_ss,
2895                                 const struct user_auth_info *user_info)
2896 {
2897         struct cli_state *cli;
2898         NTSTATUS nt_status;
2899         uint32_t flags = CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK;
2900
2901         if (user_info->use_kerberos) {
2902                 flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
2903         }
2904
2905         nt_status = cli_full_connection(&cli, NULL, server, server_ss, 0, "IPC$", "IPC",
2906                                         user_info->username ? user_info->username : "",
2907                                         lp_workgroup(),
2908                                         user_info->password ? user_info->password : "",
2909                                         flags,
2910                                         SMB_SIGNING_DEFAULT);
2911
2912         if (NT_STATUS_IS_OK(nt_status)) {
2913                 return cli;
2914         } else if (is_ipaddress(server)) {
2915             /* windows 9* needs a correct NMB name for connections */
2916             fstring remote_name;
2917
2918             if (name_status_find("*", 0, 0, server_ss, remote_name)) {
2919                 cli = get_ipc_connect(remote_name, server_ss, user_info);
2920                 if (cli)
2921                     return cli;
2922             }
2923         }
2924         return NULL;
2925 }
2926
2927 /*
2928  * Given the IP address of a master browser on the network, return its
2929  * workgroup and connect to it.
2930  *
2931  * This function is provided to allow additional processing beyond what
2932  * get_ipc_connect_master_ip_bcast() does, e.g. to retrieve the list of master
2933  * browsers and obtain each master browsers' list of domains (in case the
2934  * first master browser is recently on the network and has not yet
2935  * synchronized with other master browsers and therefore does not yet have the
2936  * entire network browse list)
2937  */
2938
2939 struct cli_state *get_ipc_connect_master_ip(TALLOC_CTX *ctx,
2940                                 struct sockaddr_storage *mb_ip,
2941                                 const struct user_auth_info *user_info,
2942                                 char **pp_workgroup_out)
2943 {
2944         char addr[INET6_ADDRSTRLEN];
2945         fstring name;
2946         struct cli_state *cli;
2947         struct sockaddr_storage server_ss;
2948
2949         *pp_workgroup_out = NULL;
2950
2951         print_sockaddr(addr, sizeof(addr), mb_ip);
2952         DEBUG(99, ("Looking up name of master browser %s\n",
2953                    addr));
2954
2955         /*
2956          * Do a name status query to find out the name of the master browser.
2957          * We use <01><02>__MSBROWSE__<02>#01 if *#00 fails because a domain
2958          * master browser will not respond to a wildcard query (or, at least,
2959          * an NT4 server acting as the domain master browser will not).
2960          *
2961          * We might be able to use ONLY the query on MSBROWSE, but that's not
2962          * yet been tested with all Windows versions, so until it is, leave
2963          * the original wildcard query as the first choice and fall back to
2964          * MSBROWSE if the wildcard query fails.
2965          */
2966         if (!name_status_find("*", 0, 0x1d, mb_ip, name) &&
2967             !name_status_find(MSBROWSE, 1, 0x1d, mb_ip, name)) {
2968
2969                 DEBUG(99, ("Could not retrieve name status for %s\n",
2970                            addr));
2971                 return NULL;
2972         }
2973
2974         if (!find_master_ip(name, &server_ss)) {
2975                 DEBUG(99, ("Could not find master ip for %s\n", name));
2976                 return NULL;
2977         }
2978
2979         *pp_workgroup_out = talloc_strdup(ctx, name);
2980
2981         DEBUG(4, ("found master browser %s, %s\n", name, addr));
2982
2983         print_sockaddr(addr, sizeof(addr), &server_ss);
2984         cli = get_ipc_connect(addr, &server_ss, user_info);
2985
2986         return cli;
2987 }
2988
2989 /*
2990  * Return the IP address and workgroup of a master browser on the network, and
2991  * connect to it.
2992  */
2993
2994 struct cli_state *get_ipc_connect_master_ip_bcast(TALLOC_CTX *ctx,
2995                                         const struct user_auth_info *user_info,
2996                                         char **pp_workgroup_out)
2997 {
2998         struct sockaddr_storage *ip_list;
2999         struct cli_state *cli;
3000         int i, count;
3001         NTSTATUS status;
3002
3003         *pp_workgroup_out = NULL;
3004
3005         DEBUG(99, ("Do broadcast lookup for workgroups on local network\n"));
3006
3007         /* Go looking for workgroups by broadcasting on the local network */
3008
3009         status = name_resolve_bcast(MSBROWSE, 1, talloc_tos(),
3010                                     &ip_list, &count);
3011         if (!NT_STATUS_IS_OK(status)) {
3012                 DEBUG(99, ("No master browsers responded: %s\n",
3013                            nt_errstr(status)));
3014                 return NULL;
3015         }
3016
3017         for (i = 0; i < count; i++) {
3018                 char addr[INET6_ADDRSTRLEN];
3019                 print_sockaddr(addr, sizeof(addr), &ip_list[i]);
3020                 DEBUG(99, ("Found master browser %s\n", addr));
3021
3022                 cli = get_ipc_connect_master_ip(ctx, &ip_list[i],
3023                                 user_info, pp_workgroup_out);
3024                 if (cli)
3025                         return(cli);
3026         }
3027
3028         return NULL;
3029 }