source3/libsmb/cliconnect.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    client connect/disconnect routines
   4    Copyright (C) Andrew Tridgell 1994-1998
   5    Copyright (C) Andrew Bartlett 2001-2003
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "../libcli/auth/libcli_auth.h"
  23 #include "../libcli/auth/spnego.h"
  24 #include "smb_krb5.h"
  25
  26 static const struct {
  27         int prot;
  28         const char name[24];
  29 } prots[10] = {
  30         {PROTOCOL_CORE,         "PC NETWORK PROGRAM 1.0"},
  31         {PROTOCOL_COREPLUS,     "MICROSOFT NETWORKS 1.03"},
  32         {PROTOCOL_LANMAN1,      "MICROSOFT NETWORKS 3.0"},
  33         {PROTOCOL_LANMAN1,      "LANMAN1.0"},
  34         {PROTOCOL_LANMAN2,      "LM1.2X002"},
  35         {PROTOCOL_LANMAN2,      "DOS LANMAN2.1"},
  36         {PROTOCOL_LANMAN2,      "LANMAN2.1"},
  37         {PROTOCOL_LANMAN2,      "Samba"},
  38         {PROTOCOL_NT1,          "NT LANMAN 1.0"},
  39         {PROTOCOL_NT1,          "NT LM 0.12"},
  40 };
  41
  42 #define STAR_SMBSERVER "*SMBSERVER"
  43
  44 /**
  45  * Set the user session key for a connection
  46  * @param cli The cli structure to add it too
  47  * @param session_key The session key used.  (A copy of this is taken for the cli struct)
  48  *
  49  */
  50
  51 static void cli_set_session_key (struct cli_state *cli, const DATA_BLOB session_key)
  52 {
  53         cli->user_session_key = data_blob(session_key.data, session_key.length);
  54 }
  55
  56 /****************************************************************************
  57  Do an old lanman2 style session setup.
  58 ****************************************************************************/
  59
  60 static NTSTATUS cli_session_setup_lanman2(struct cli_state *cli,
  61                                           const char *user,
  62                                           const char *pass, size_t passlen,
  63                                           const char *workgroup)
  64 {
  65         DATA_BLOB session_key = data_blob_null;
  66         DATA_BLOB lm_response = data_blob_null;
  67         NTSTATUS status;
  68         fstring pword;
  69         char *p;
  70
  71         if (passlen > sizeof(pword)-1) {
  72                 return NT_STATUS_INVALID_PARAMETER;
  73         }
  74
  75         /* LANMAN servers predate NT status codes and Unicode and ignore those
  76            smb flags so we must disable the corresponding default capabilities
  77            that would otherwise cause the Unicode and NT Status flags to be
  78            set (and even returned by the server) */
  79
  80         cli->capabilities &= ~(CAP_UNICODE | CAP_STATUS32);
  81
  82         /* if in share level security then don't send a password now */
  83         if (!(cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL))
  84                 passlen = 0;
  85
  86         if (passlen > 0 && (cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) && passlen != 24) {
  87                 /* Encrypted mode needed, and non encrypted password supplied. */
  88                 lm_response = data_blob(NULL, 24);
  89                 if (!SMBencrypt(pass, cli->secblob.data,(uchar *)lm_response.data)) {
  90                         DEBUG(1, ("Password is > 14 chars in length, and is therefore incompatible with Lanman authentication\n"));
  91                         return NT_STATUS_ACCESS_DENIED;
  92                 }
  93         } else if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) && passlen == 24) {
  94                 /* Encrypted mode needed, and encrypted password supplied. */
  95                 lm_response = data_blob(pass, passlen);
  96         } else if (passlen > 0) {
  97                 /* Plaintext mode needed, assume plaintext supplied. */
  98                 passlen = clistr_push(cli, pword, pass, sizeof(pword), STR_TERMINATE);
  99                 lm_response = data_blob(pass, passlen);
 100         }
 101
 102         /* send a session setup command */
 103         memset(cli->outbuf,'\0',smb_size);
 104         cli_set_message(cli->outbuf,10, 0, True);
 105         SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
 106         cli_setup_packet(cli);
 107
 108         SCVAL(cli->outbuf,smb_vwv0,0xFF);
 109         SSVAL(cli->outbuf,smb_vwv2,cli->max_xmit);
 110         SSVAL(cli->outbuf,smb_vwv3,2);
 111         SSVAL(cli->outbuf,smb_vwv4,1);
 112         SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
 113         SSVAL(cli->outbuf,smb_vwv7,lm_response.length);
 114
 115         p = smb_buf(cli->outbuf);
 116         memcpy(p,lm_response.data,lm_response.length);
 117         p += lm_response.length;
 118         p += clistr_push(cli, p, user, -1, STR_TERMINATE|STR_UPPER);
 119         p += clistr_push(cli, p, workgroup, -1, STR_TERMINATE|STR_UPPER);
 120         p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
 121         p += clistr_push(cli, p, "Samba", -1, STR_TERMINATE);
 122         cli_setup_bcc(cli, p);
 123
 124         if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
 125                 return cli_nt_error(cli);
 126         }
 127
 128         show_msg(cli->inbuf);
 129
 130         if (cli_is_error(cli)) {
 131                 return cli_nt_error(cli);
 132         }
 133
 134         /* use the returned vuid from now on */
 135         cli->vuid = SVAL(cli->inbuf,smb_uid);
 136         status = cli_set_username(cli, user);
 137         if (!NT_STATUS_IS_OK(status)) {
 138                 return status;
 139         }
 140
 141         if (session_key.data) {
 142                 /* Have plaintext orginal */
 143                 cli_set_session_key(cli, session_key);
 144         }
 145
 146         return NT_STATUS_OK;
 147 }
 148
 149 /****************************************************************************
 150  Work out suitable capabilities to offer the server.
 151 ****************************************************************************/
 152
 153 static uint32 cli_session_setup_capabilities(struct cli_state *cli)
 154 {
 155         uint32 capabilities = CAP_NT_SMBS;
 156
 157         if (!cli->force_dos_errors)
 158                 capabilities |= CAP_STATUS32;
 159
 160         if (cli->use_level_II_oplocks)
 161                 capabilities |= CAP_LEVEL_II_OPLOCKS;
 162
 163         capabilities |= (cli->capabilities & (CAP_UNICODE|CAP_LARGE_FILES|CAP_LARGE_READX|CAP_LARGE_WRITEX|CAP_DFS));
 164         return capabilities;
 165 }
 166
 167 /****************************************************************************
 168  Do a NT1 guest session setup.
 169 ****************************************************************************/
 170
 171 struct cli_session_setup_guest_state {
 172         struct cli_state *cli;
 173         uint16_t vwv[16];
 174         struct iovec bytes;
 175 };
 176
 177 static void cli_session_setup_guest_done(struct tevent_req *subreq);
 178
 179 struct tevent_req *cli_session_setup_guest_create(TALLOC_CTX *mem_ctx,
 180                                                   struct event_context *ev,
 181                                                   struct cli_state *cli,
 182                                                   struct tevent_req **psmbreq)
 183 {
 184         struct tevent_req *req, *subreq;
 185         struct cli_session_setup_guest_state *state;
 186         uint16_t *vwv;
 187         uint8_t *bytes;
 188
 189         req = tevent_req_create(mem_ctx, &state,
 190                                 struct cli_session_setup_guest_state);
 191         if (req == NULL) {
 192                 return NULL;
 193         }
 194         state->cli = cli;
 195         vwv = state->vwv;
 196
 197         SCVAL(vwv+0, 0, 0xFF);
 198         SCVAL(vwv+0, 1, 0);
 199         SSVAL(vwv+1, 0, 0);
 200         SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
 201         SSVAL(vwv+3, 0, 2);
 202         SSVAL(vwv+4, 0, cli->pid);
 203         SIVAL(vwv+5, 0, cli->sesskey);
 204         SSVAL(vwv+7, 0, 0);
 205         SSVAL(vwv+8, 0, 0);
 206         SSVAL(vwv+9, 0, 0);
 207         SSVAL(vwv+10, 0, 0);
 208         SIVAL(vwv+11, 0, cli_session_setup_capabilities(cli));
 209
 210         bytes = talloc_array(state, uint8_t, 0);
 211
 212         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "",  1, /* username */
 213                                    NULL);
 214         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "", 1, /* workgroup */
 215                                    NULL);
 216         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Unix", 5, NULL);
 217         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Samba", 6, NULL);
 218
 219         if (bytes == NULL) {
 220                 TALLOC_FREE(req);
 221                 return NULL;
 222         }
 223
 224         state->bytes.iov_base = (void *)bytes;
 225         state->bytes.iov_len = talloc_get_size(bytes);
 226
 227         subreq = cli_smb_req_create(state, ev, cli, SMBsesssetupX, 0, 13, vwv,
 228                                     1, &state->bytes);
 229         if (subreq == NULL) {
 230                 TALLOC_FREE(req);
 231                 return NULL;
 232         }
 233         tevent_req_set_callback(subreq, cli_session_setup_guest_done, req);
 234         *psmbreq = subreq;
 235         return req;
 236 }
 237
 238 struct tevent_req *cli_session_setup_guest_send(TALLOC_CTX *mem_ctx,
 239                                                 struct event_context *ev,
 240                                                 struct cli_state *cli)
 241 {
 242         struct tevent_req *req, *subreq;
 243         NTSTATUS status;
 244
 245         req = cli_session_setup_guest_create(mem_ctx, ev, cli, &subreq);
 246         if (req == NULL) {
 247                 return NULL;
 248         }
 249
 250         status = cli_smb_req_send(subreq);
 251         if (NT_STATUS_IS_OK(status)) {
 252                 tevent_req_nterror(req, status);
 253                 return tevent_req_post(req, ev);
 254         }
 255         return req;
 256 }
 257
 258 static void cli_session_setup_guest_done(struct tevent_req *subreq)
 259 {
 260         struct tevent_req *req = tevent_req_callback_data(
 261                 subreq, struct tevent_req);
 262         struct cli_session_setup_guest_state *state = tevent_req_data(
 263                 req, struct cli_session_setup_guest_state);
 264         struct cli_state *cli = state->cli;
 265         uint32_t num_bytes;
 266         char *inbuf;
 267         uint8_t *bytes;
 268         uint8_t *p;
 269         NTSTATUS status;
 270
 271         status = cli_smb_recv(subreq, 0, NULL, NULL, &num_bytes, &bytes);
 272         if (!NT_STATUS_IS_OK(status)) {
 273                 TALLOC_FREE(subreq);
 274                 tevent_req_nterror(req, status);
 275                 return;
 276         }
 277
 278         inbuf = (char *)cli_smb_inbuf(subreq);
 279         p = bytes;
 280
 281         cli->vuid = SVAL(inbuf, smb_uid);
 282
 283         p += clistr_pull(inbuf, cli->server_os, (char *)p, sizeof(fstring),
 284                          bytes+num_bytes-p, STR_TERMINATE);
 285         p += clistr_pull(inbuf, cli->server_type, (char *)p, sizeof(fstring),
 286                          bytes+num_bytes-p, STR_TERMINATE);
 287         p += clistr_pull(inbuf, cli->server_domain, (char *)p, sizeof(fstring),
 288                          bytes+num_bytes-p, STR_TERMINATE);
 289
 290         if (strstr(cli->server_type, "Samba")) {
 291                 cli->is_samba = True;
 292         }
 293
 294         TALLOC_FREE(subreq);
 295
 296         status = cli_set_username(cli, "");
 297         if (!NT_STATUS_IS_OK(status)) {
 298                 tevent_req_nterror(req, status);
 299                 return;
 300         }
 301         tevent_req_done(req);
 302 }
 303
 304 NTSTATUS cli_session_setup_guest_recv(struct tevent_req *req)
 305 {
 306         return tevent_req_simple_recv_ntstatus(req);
 307 }
 308
 309 static NTSTATUS cli_session_setup_guest(struct cli_state *cli)
 310 {
 311         TALLOC_CTX *frame = talloc_stackframe();
 312         struct event_context *ev;
 313         struct tevent_req *req;
 314         NTSTATUS status = NT_STATUS_OK;
 315
 316         if (cli_has_async_calls(cli)) {
 317                 /*
 318                  * Can't use sync call while an async call is in flight
 319                  */
 320                 status = NT_STATUS_INVALID_PARAMETER;
 321                 goto fail;
 322         }
 323
 324         ev = event_context_init(frame);
 325         if (ev == NULL) {
 326                 status = NT_STATUS_NO_MEMORY;
 327                 goto fail;
 328         }
 329
 330         req = cli_session_setup_guest_send(frame, ev, cli);
 331         if (req == NULL) {
 332                 status = NT_STATUS_NO_MEMORY;
 333                 goto fail;
 334         }
 335
 336         if (!tevent_req_poll(req, ev)) {
 337                 status = map_nt_error_from_unix(errno);
 338                 goto fail;
 339         }
 340
 341         status = cli_session_setup_guest_recv(req);
 342  fail:
 343         TALLOC_FREE(frame);
 344         if (!NT_STATUS_IS_OK(status)) {
 345                 cli_set_error(cli, status);
 346         }
 347         return status;
 348 }
 349
 350 /****************************************************************************
 351  Do a NT1 plaintext session setup.
 352 ****************************************************************************/
 353
 354 static NTSTATUS cli_session_setup_plaintext(struct cli_state *cli,
 355                                             const char *user, const char *pass,
 356                                             const char *workgroup)
 357 {
 358         uint32 capabilities = cli_session_setup_capabilities(cli);
 359         char *p;
 360         NTSTATUS status;
 361         fstring lanman;
 362
 363         fstr_sprintf( lanman, "Samba %s", samba_version_string());
 364
 365         memset(cli->outbuf, '\0', smb_size);
 366         cli_set_message(cli->outbuf,13,0,True);
 367         SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
 368         cli_setup_packet(cli);
 369
 370         SCVAL(cli->outbuf,smb_vwv0,0xFF);
 371         SSVAL(cli->outbuf,smb_vwv2,CLI_BUFFER_SIZE);
 372         SSVAL(cli->outbuf,smb_vwv3,2);
 373         SSVAL(cli->outbuf,smb_vwv4,cli->pid);
 374         SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
 375         SSVAL(cli->outbuf,smb_vwv8,0);
 376         SIVAL(cli->outbuf,smb_vwv11,capabilities);
 377         p = smb_buf(cli->outbuf);
 378
 379         /* check wether to send the ASCII or UNICODE version of the password */
 380
 381         if ( (capabilities & CAP_UNICODE) == 0 ) {
 382                 p += clistr_push(cli, p, pass, -1, STR_TERMINATE); /* password */
 383                 SSVAL(cli->outbuf,smb_vwv7,PTR_DIFF(p, smb_buf(cli->outbuf)));
 384         }
 385         else {
 386                 /* For ucs2 passwords clistr_push calls ucs2_align, which causes
 387                  * the space taken by the unicode password to be one byte too
 388                  * long (as we're on an odd byte boundary here). Reduce the
 389                  * count by 1 to cope with this. Fixes smbclient against NetApp
 390                  * servers which can't cope. Fix from
 391                  * bryan.kolodziej@allenlund.com in bug #3840.
 392                  */
 393                 p += clistr_push(cli, p, pass, -1, STR_UNICODE|STR_TERMINATE); /* unicode password */
 394                 SSVAL(cli->outbuf,smb_vwv8,PTR_DIFF(p, smb_buf(cli->outbuf))-1);
 395         }
 396
 397         p += clistr_push(cli, p, user, -1, STR_TERMINATE); /* username */
 398         p += clistr_push(cli, p, workgroup, -1, STR_TERMINATE); /* workgroup */
 399         p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
 400         p += clistr_push(cli, p, lanman, -1, STR_TERMINATE);
 401         cli_setup_bcc(cli, p);
 402
 403         if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
 404                 return cli_nt_error(cli);
 405         }
 406
 407         show_msg(cli->inbuf);
 408
 409         if (cli_is_error(cli)) {
 410                 return cli_nt_error(cli);
 411         }
 412
 413         cli->vuid = SVAL(cli->inbuf,smb_uid);
 414         p = smb_buf(cli->inbuf);
 415         p += clistr_pull(cli->inbuf, cli->server_os, p, sizeof(fstring),
 416                          -1, STR_TERMINATE);
 417         p += clistr_pull(cli->inbuf, cli->server_type, p, sizeof(fstring),
 418                          -1, STR_TERMINATE);
 419         p += clistr_pull(cli->inbuf, cli->server_domain, p, sizeof(fstring),
 420                          -1, STR_TERMINATE);
 421         status = cli_set_username(cli, user);
 422         if (!NT_STATUS_IS_OK(status)) {
 423                 return status;
 424         }
 425         if (strstr(cli->server_type, "Samba")) {
 426                 cli->is_samba = True;
 427         }
 428
 429         return NT_STATUS_OK;
 430 }
 431
 432 /****************************************************************************
 433    do a NT1 NTLM/LM encrypted session setup - for when extended security
 434    is not negotiated.
 435    @param cli client state to create do session setup on
 436    @param user username
 437    @param pass *either* cleartext password (passlen !=24) or LM response.
 438    @param ntpass NT response, implies ntpasslen >=24, implies pass is not clear
 439    @param workgroup The user's domain.
 440 ****************************************************************************/
 441
 442 static NTSTATUS cli_session_setup_nt1(struct cli_state *cli, const char *user,
 443                                       const char *pass, size_t passlen,
 444                                       const char *ntpass, size_t ntpasslen,
 445                                       const char *workgroup)
 446 {
 447         uint32 capabilities = cli_session_setup_capabilities(cli);
 448         DATA_BLOB lm_response = data_blob_null;
 449         DATA_BLOB nt_response = data_blob_null;
 450         DATA_BLOB session_key = data_blob_null;
 451         NTSTATUS result;
 452         char *p;
 453         bool ok;
 454
 455         if (passlen == 0) {
 456                 /* do nothing - guest login */
 457         } else if (passlen != 24) {
 458                 if (lp_client_ntlmv2_auth()) {
 459                         DATA_BLOB server_chal;
 460                         DATA_BLOB names_blob;
 461                         server_chal = data_blob(cli->secblob.data, MIN(cli->secblob.length, 8));
 462
 463                         /* note that the 'workgroup' here is a best guess - we don't know
 464                            the server's domain at this point.  The 'server name' is also
 465                            dodgy...
 466                         */
 467                         names_blob = NTLMv2_generate_names_blob(NULL, cli->called.name, workgroup);
 468
 469                         if (!SMBNTLMv2encrypt(NULL, user, workgroup, pass, &server_chal,
 470                                               &names_blob,
 471                                               &lm_response, &nt_response, NULL, &session_key)) {
 472                                 data_blob_free(&names_blob);
 473                                 data_blob_free(&server_chal);
 474                                 return NT_STATUS_ACCESS_DENIED;
 475                         }
 476                         data_blob_free(&names_blob);
 477                         data_blob_free(&server_chal);
 478
 479                 } else {
 480                         uchar nt_hash[16];
 481                         E_md4hash(pass, nt_hash);
 482
 483 #ifdef LANMAN_ONLY
 484                         nt_response = data_blob_null;
 485 #else
 486                         nt_response = data_blob(NULL, 24);
 487                         SMBNTencrypt(pass,cli->secblob.data,nt_response.data);
 488 #endif
 489                         /* non encrypted password supplied. Ignore ntpass. */
 490                         if (lp_client_lanman_auth()) {
 491                                 lm_response = data_blob(NULL, 24);
 492                                 if (!SMBencrypt(pass,cli->secblob.data, lm_response.data)) {
 493                                         /* Oops, the LM response is invalid, just put
 494                                            the NT response there instead */
 495                                         data_blob_free(&lm_response);
 496                                         lm_response = data_blob(nt_response.data, nt_response.length);
 497                                 }
 498                         } else {
 499                                 /* LM disabled, place NT# in LM field instead */
 500                                 lm_response = data_blob(nt_response.data, nt_response.length);
 501                         }
 502
 503                         session_key = data_blob(NULL, 16);
 504 #ifdef LANMAN_ONLY
 505                         E_deshash(pass, session_key.data);
 506                         memset(&session_key.data[8], '\0', 8);
 507 #else
 508                         SMBsesskeygen_ntv1(nt_hash, session_key.data);
 509 #endif
 510                 }
 511                 cli_temp_set_signing(cli);
 512         } else {
 513                 /* pre-encrypted password supplied.  Only used for
 514                    security=server, can't do
 515                    signing because we don't have original key */
 516
 517                 lm_response = data_blob(pass, passlen);
 518                 nt_response = data_blob(ntpass, ntpasslen);
 519         }
 520
 521         /* send a session setup command */
 522         memset(cli->outbuf,'\0',smb_size);
 523
 524         cli_set_message(cli->outbuf,13,0,True);
 525         SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
 526         cli_setup_packet(cli);
 527
 528         SCVAL(cli->outbuf,smb_vwv0,0xFF);
 529         SSVAL(cli->outbuf,smb_vwv2,CLI_BUFFER_SIZE);
 530         SSVAL(cli->outbuf,smb_vwv3,2);
 531         SSVAL(cli->outbuf,smb_vwv4,cli->pid);
 532         SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
 533         SSVAL(cli->outbuf,smb_vwv7,lm_response.length);
 534         SSVAL(cli->outbuf,smb_vwv8,nt_response.length);
 535         SIVAL(cli->outbuf,smb_vwv11,capabilities);
 536         p = smb_buf(cli->outbuf);
 537         if (lm_response.length) {
 538                 memcpy(p,lm_response.data, lm_response.length); p += lm_response.length;
 539         }
 540         if (nt_response.length) {
 541                 memcpy(p,nt_response.data, nt_response.length); p += nt_response.length;
 542         }
 543         p += clistr_push(cli, p, user, -1, STR_TERMINATE);
 544
 545         /* Upper case here might help some NTLMv2 implementations */
 546         p += clistr_push(cli, p, workgroup, -1, STR_TERMINATE|STR_UPPER);
 547         p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
 548         p += clistr_push(cli, p, "Samba", -1, STR_TERMINATE);
 549         cli_setup_bcc(cli, p);
 550
 551         if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
 552                 result = cli_nt_error(cli);
 553                 goto end;
 554         }
 555
 556         /* show_msg(cli->inbuf); */
 557
 558         if (cli_is_error(cli)) {
 559                 result = cli_nt_error(cli);
 560                 goto end;
 561         }
 562
 563 #ifdef LANMAN_ONLY
 564         ok = cli_simple_set_signing(cli, session_key, lm_response);
 565 #else
 566         ok = cli_simple_set_signing(cli, session_key, nt_response);
 567 #endif
 568         if (ok) {
 569                 if (!cli_check_sign_mac(cli, cli->inbuf, 1)) {
 570                         result = NT_STATUS_ACCESS_DENIED;
 571                         goto end;
 572                 }
 573         }
 574
 575         /* use the returned vuid from now on */
 576         cli->vuid = SVAL(cli->inbuf,smb_uid);
 577
 578         p = smb_buf(cli->inbuf);
 579         p += clistr_pull(cli->inbuf, cli->server_os, p, sizeof(fstring),
 580                          -1, STR_TERMINATE);
 581         p += clistr_pull(cli->inbuf, cli->server_type, p, sizeof(fstring),
 582                          -1, STR_TERMINATE);
 583         p += clistr_pull(cli->inbuf, cli->server_domain, p, sizeof(fstring),
 584                          -1, STR_TERMINATE);
 585
 586         if (strstr(cli->server_type, "Samba")) {
 587                 cli->is_samba = True;
 588         }
 589
 590         result = cli_set_username(cli, user);
 591         if (!NT_STATUS_IS_OK(result)) {
 592                 goto end;
 593         }
 594
 595         if (session_key.data) {
 596                 /* Have plaintext orginal */
 597                 cli_set_session_key(cli, session_key);
 598         }
 599
 600         result = NT_STATUS_OK;
 601 end:
 602         data_blob_free(&lm_response);
 603         data_blob_free(&nt_response);
 604         data_blob_free(&session_key);
 605         return result;
 606 }
 607
 608 /****************************************************************************
 609  Send a extended security session setup blob
 610 ****************************************************************************/
 611
 612 static bool cli_session_setup_blob_send(struct cli_state *cli, DATA_BLOB blob)
 613 {
 614         uint32 capabilities = cli_session_setup_capabilities(cli);
 615         char *p;
 616
 617         capabilities |= CAP_EXTENDED_SECURITY;
 618
 619         /* send a session setup command */
 620         memset(cli->outbuf,'\0',smb_size);
 621
 622         cli_set_message(cli->outbuf,12,0,True);
 623         SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
 624
 625         cli_setup_packet(cli);
 626
 627         SCVAL(cli->outbuf,smb_vwv0,0xFF);
 628         SSVAL(cli->outbuf,smb_vwv2,CLI_BUFFER_SIZE);
 629         SSVAL(cli->outbuf,smb_vwv3,2);
 630         SSVAL(cli->outbuf,smb_vwv4,1);
 631         SIVAL(cli->outbuf,smb_vwv5,0);
 632         SSVAL(cli->outbuf,smb_vwv7,blob.length);
 633         SIVAL(cli->outbuf,smb_vwv10,capabilities);
 634         p = smb_buf(cli->outbuf);
 635         memcpy(p, blob.data, blob.length);
 636         p += blob.length;
 637         p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
 638         p += clistr_push(cli, p, "Samba", -1, STR_TERMINATE);
 639         cli_setup_bcc(cli, p);
 640         return cli_send_smb(cli);
 641 }
 642
 643 /****************************************************************************
 644  Send a extended security session setup blob, returning a reply blob.
 645 ****************************************************************************/
 646
 647 static DATA_BLOB cli_session_setup_blob_receive(struct cli_state *cli)
 648 {
 649         DATA_BLOB blob2 = data_blob_null;
 650         char *p;
 651         size_t len;
 652
 653         if (!cli_receive_smb(cli))
 654                 return blob2;
 655
 656         show_msg(cli->inbuf);
 657
 658         if (cli_is_error(cli) && !NT_STATUS_EQUAL(cli_nt_error(cli),
 659                                                   NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 660                 return blob2;
 661         }
 662
 663         /* use the returned vuid from now on */
 664         cli->vuid = SVAL(cli->inbuf,smb_uid);
 665
 666         p = smb_buf(cli->inbuf);
 667
 668         blob2 = data_blob(p, SVAL(cli->inbuf, smb_vwv3));
 669
 670         p += blob2.length;
 671         p += clistr_pull(cli->inbuf, cli->server_os, p, sizeof(fstring),
 672                          -1, STR_TERMINATE);
 673
 674         /* w2k with kerberos doesn't properly null terminate this field */
 675         len = smb_bufrem(cli->inbuf, p);
 676         if (p + len < cli->inbuf + cli->bufsize+SAFETY_MARGIN - 2) {
 677                 char *end_of_buf = p + len;
 678
 679                 SSVAL(p, len, 0);
 680                 /* Now it's null terminated. */
 681                 p += clistr_pull(cli->inbuf, cli->server_type, p, sizeof(fstring),
 682                         -1, STR_TERMINATE);
 683                 /*
 684                  * See if there's another string. If so it's the
 685                  * server domain (part of the 'standard' Samba
 686                  * server signature).
 687                  */
 688                 if (p < end_of_buf) {
 689                         p += clistr_pull(cli->inbuf, cli->server_domain, p, sizeof(fstring),
 690                                 -1, STR_TERMINATE);
 691                 }
 692         } else {
 693                 /*
 694                  * No room to null terminate so we can't see if there
 695                  * is another string (server_domain) afterwards.
 696                  */
 697                 p += clistr_pull(cli->inbuf, cli->server_type, p, sizeof(fstring),
 698                                  len, 0);
 699         }
 700         return blob2;
 701 }
 702
 703 #ifdef HAVE_KRB5
 704 /****************************************************************************
 705  Send a extended security session setup blob, returning a reply blob.
 706 ****************************************************************************/
 707
 708 /* The following is calculated from :
 709  * (smb_size-4) = 35
 710  * (smb_wcnt * 2) = 24 (smb_wcnt == 12 in cli_session_setup_blob_send() )
 711  * (strlen("Unix") + 1 + strlen("Samba") + 1) * 2 = 22 (unicode strings at
 712  * end of packet.
 713  */
 714
 715 #define BASE_SESSSETUP_BLOB_PACKET_SIZE (35 + 24 + 22)
 716
 717 static bool cli_session_setup_blob(struct cli_state *cli, DATA_BLOB blob)
 718 {
 719         int32 remaining = blob.length;
 720         int32 cur = 0;
 721         DATA_BLOB send_blob = data_blob_null;
 722         int32 max_blob_size = 0;
 723         DATA_BLOB receive_blob = data_blob_null;
 724
 725         if (cli->max_xmit < BASE_SESSSETUP_BLOB_PACKET_SIZE + 1) {
 726                 DEBUG(0,("cli_session_setup_blob: cli->max_xmit too small "
 727                         "(was %u, need minimum %u)\n",
 728                         (unsigned int)cli->max_xmit,
 729                         BASE_SESSSETUP_BLOB_PACKET_SIZE));
 730                 cli_set_nt_error(cli, NT_STATUS_INVALID_PARAMETER);
 731                 return False;
 732         }
 733
 734         max_blob_size = cli->max_xmit - BASE_SESSSETUP_BLOB_PACKET_SIZE;
 735
 736         while ( remaining > 0) {
 737                 if (remaining >= max_blob_size) {
 738                         send_blob.length = max_blob_size;
 739                         remaining -= max_blob_size;
 740                 } else {
 741                         send_blob.length = remaining;
 742                         remaining = 0;
 743                 }
 744
 745                 send_blob.data =  &blob.data[cur];
 746                 cur += send_blob.length;
 747
 748                 DEBUG(10, ("cli_session_setup_blob: Remaining (%u) sending (%u) current (%u)\n",
 749                         (unsigned int)remaining,
 750                         (unsigned int)send_blob.length,
 751                         (unsigned int)cur ));
 752
 753                 if (!cli_session_setup_blob_send(cli, send_blob)) {
 754                         DEBUG(0, ("cli_session_setup_blob: send failed\n"));
 755                         return False;
 756                 }
 757
 758                 receive_blob = cli_session_setup_blob_receive(cli);
 759                 data_blob_free(&receive_blob);
 760
 761                 if (cli_is_error(cli) &&
 762                                 !NT_STATUS_EQUAL( cli_get_nt_error(cli),
 763                                         NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 764                         DEBUG(0, ("cli_session_setup_blob: receive failed "
 765                                   "(%s)\n", nt_errstr(cli_get_nt_error(cli))));
 766                         cli->vuid = 0;
 767                         return False;
 768                 }
 769         }
 770
 771         return True;
 772 }
 773
 774 /****************************************************************************
 775  Use in-memory credentials cache
 776 ****************************************************************************/
 777
 778 static void use_in_memory_ccache(void) {
 779         setenv(KRB5_ENV_CCNAME, "MEMORY:cliconnect", 1);
 780 }
 781
 782 /****************************************************************************
 783  Do a spnego/kerberos encrypted session setup.
 784 ****************************************************************************/
 785
 786 static ADS_STATUS cli_session_setup_kerberos(struct cli_state *cli, const char *principal, const char *workgroup)
 787 {
 788         DATA_BLOB negTokenTarg;
 789         DATA_BLOB session_key_krb5;
 790         NTSTATUS nt_status;
 791         int rc;
 792
 793         cli_temp_set_signing(cli);
 794
 795         DEBUG(2,("Doing kerberos session setup\n"));
 796
 797         /* generate the encapsulated kerberos5 ticket */
 798         rc = spnego_gen_negTokenTarg(principal, 0, &negTokenTarg, &session_key_krb5, 0, NULL);
 799
 800         if (rc) {
 801                 DEBUG(1, ("cli_session_setup_kerberos: spnego_gen_negTokenTarg failed: %s\n",
 802                         error_message(rc)));
 803                 return ADS_ERROR_KRB5(rc);
 804         }
 805
 806 #if 0
 807         file_save("negTokenTarg.dat", negTokenTarg.data, negTokenTarg.length);
 808 #endif
 809
 810         if (!cli_session_setup_blob(cli, negTokenTarg)) {
 811                 nt_status = cli_nt_error(cli);
 812                 goto nt_error;
 813         }
 814
 815         if (cli_is_error(cli)) {
 816                 nt_status = cli_nt_error(cli);
 817                 if (NT_STATUS_IS_OK(nt_status)) {
 818                         nt_status = NT_STATUS_UNSUCCESSFUL;
 819                 }
 820                 goto nt_error;
 821         }
 822
 823         cli_set_session_key(cli, session_key_krb5);
 824
 825         if (cli_simple_set_signing(
 826                     cli, session_key_krb5, data_blob_null)) {
 827
 828                 if (!cli_check_sign_mac(cli, cli->inbuf, 1)) {
 829                         nt_status = NT_STATUS_ACCESS_DENIED;
 830                         goto nt_error;
 831                 }
 832         }
 833
 834         data_blob_free(&negTokenTarg);
 835         data_blob_free(&session_key_krb5);
 836
 837         return ADS_ERROR_NT(NT_STATUS_OK);
 838
 839 nt_error:
 840         data_blob_free(&negTokenTarg);
 841         data_blob_free(&session_key_krb5);
 842         cli->vuid = 0;
 843         return ADS_ERROR_NT(nt_status);
 844 }
 845 #endif  /* HAVE_KRB5 */
 846
 847
 848 /****************************************************************************
 849  Do a spnego/NTLMSSP encrypted session setup.
 850 ****************************************************************************/
 851
 852 static NTSTATUS cli_session_setup_ntlmssp(struct cli_state *cli, const char *user,
 853                                           const char *pass, const char *domain)
 854 {
 855         struct ntlmssp_state *ntlmssp_state;
 856         NTSTATUS nt_status;
 857         int turn = 1;
 858         DATA_BLOB msg1;
 859         DATA_BLOB blob = data_blob_null;
 860         DATA_BLOB blob_in = data_blob_null;
 861         DATA_BLOB blob_out = data_blob_null;
 862
 863         cli_temp_set_signing(cli);
 864
 865         if (!NT_STATUS_IS_OK(nt_status = ntlmssp_client_start(&ntlmssp_state))) {
 866                 return nt_status;
 867         }
 868         ntlmssp_want_feature(ntlmssp_state, NTLMSSP_FEATURE_SESSION_KEY);
 869
 870         if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_username(ntlmssp_state, user))) {
 871                 return nt_status;
 872         }
 873         if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_domain(ntlmssp_state, domain))) {
 874                 return nt_status;
 875         }
 876         if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_password(ntlmssp_state, pass))) {
 877                 return nt_status;
 878         }
 879
 880         do {
 881                 nt_status = ntlmssp_update(ntlmssp_state,
 882                                                   blob_in, &blob_out);
 883                 data_blob_free(&blob_in);
 884                 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED) || NT_STATUS_IS_OK(nt_status)) {
 885                         if (turn == 1) {
 886                                 /* and wrap it in a SPNEGO wrapper */
 887                                 msg1 = gen_negTokenInit(OID_NTLMSSP, blob_out);
 888                         } else {
 889                                 /* wrap it in SPNEGO */
 890                                 msg1 = spnego_gen_auth(blob_out);
 891                         }
 892
 893                         /* now send that blob on its way */
 894                         if (!cli_session_setup_blob_send(cli, msg1)) {
 895                                 DEBUG(3, ("Failed to send NTLMSSP/SPNEGO blob to server!\n"));
 896                                 nt_status = NT_STATUS_UNSUCCESSFUL;
 897                         } else {
 898                                 blob = cli_session_setup_blob_receive(cli);
 899
 900                                 nt_status = cli_nt_error(cli);
 901                                 if (cli_is_error(cli) && NT_STATUS_IS_OK(nt_status)) {
 902                                         if (cli->smb_rw_error == SMB_READ_BAD_SIG) {
 903                                                 nt_status = NT_STATUS_ACCESS_DENIED;
 904                                         } else {
 905                                                 nt_status = NT_STATUS_UNSUCCESSFUL;
 906                                         }
 907                                 }
 908                         }
 909                         data_blob_free(&msg1);
 910                 }
 911
 912                 if (!blob.length) {
 913                         if (NT_STATUS_IS_OK(nt_status)) {
 914                                 nt_status = NT_STATUS_UNSUCCESSFUL;
 915                         }
 916                 } else if ((turn == 1) &&
 917                            NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 918                         DATA_BLOB tmp_blob = data_blob_null;
 919                         /* the server might give us back two challenges */
 920                         if (!spnego_parse_challenge(blob, &blob_in,
 921                                                     &tmp_blob)) {
 922                                 DEBUG(3,("Failed to parse challenges\n"));
 923                                 nt_status = NT_STATUS_INVALID_PARAMETER;
 924                         }
 925                         data_blob_free(&tmp_blob);
 926                 } else {
 927                         if (!spnego_parse_auth_response(blob, nt_status, OID_NTLMSSP,
 928                                                         &blob_in)) {
 929                                 DEBUG(3,("Failed to parse auth response\n"));
 930                                 if (NT_STATUS_IS_OK(nt_status)
 931                                     || NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED))
 932                                         nt_status = NT_STATUS_INVALID_PARAMETER;
 933                         }
 934                 }
 935                 data_blob_free(&blob);
 936                 data_blob_free(&blob_out);
 937                 turn++;
 938         } while (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED));
 939
 940         data_blob_free(&blob_in);
 941
 942         if (NT_STATUS_IS_OK(nt_status)) {
 943
 944                 if (cli->server_domain[0] == '\0') {
 945                         fstrcpy(cli->server_domain, ntlmssp_state->server_domain);
 946                 }
 947                 cli_set_session_key(cli, ntlmssp_state->session_key);
 948
 949                 if (cli_simple_set_signing(
 950                             cli, ntlmssp_state->session_key, data_blob_null)) {
 951
 952                         if (!cli_check_sign_mac(cli, cli->inbuf, 1)) {
 953                                 nt_status = NT_STATUS_ACCESS_DENIED;
 954                         }
 955                 }
 956         }
 957
 958         /* we have a reference conter on ntlmssp_state, if we are signing
 959            then the state will be kept by the signing engine */
 960
 961         ntlmssp_end(&ntlmssp_state);
 962
 963         if (!NT_STATUS_IS_OK(nt_status)) {
 964                 cli->vuid = 0;
 965         }
 966         return nt_status;
 967 }
 968
 969 /****************************************************************************
 970  Do a spnego encrypted session setup.
 971
 972  user_domain: The shortname of the domain the user/machine is a member of.
 973  dest_realm: The realm we're connecting to, if NULL we use our default realm.
 974 ****************************************************************************/
 975
 976 ADS_STATUS cli_session_setup_spnego(struct cli_state *cli, const char *user,
 977                               const char *pass, const char *user_domain,
 978                               const char * dest_realm)
 979 {
 980         char *principal = NULL;
 981         char *OIDs[ASN1_MAX_OIDS];
 982         int i;
 983         DATA_BLOB blob;
 984         const char *p = NULL;
 985         char *account = NULL;
 986         NTSTATUS status;
 987
 988         DEBUG(3,("Doing spnego session setup (blob length=%lu)\n", (unsigned long)cli->secblob.length));
 989
 990         /* the server might not even do spnego */
 991         if (cli->secblob.length <= 16) {
 992                 DEBUG(3,("server didn't supply a full spnego negprot\n"));
 993                 goto ntlmssp;
 994         }
 995
 996 #if 0
 997         file_save("negprot.dat", cli->secblob.data, cli->secblob.length);
 998 #endif
 999
1000         /* there is 16 bytes of GUID before the real spnego packet starts */
1001         blob = data_blob(cli->secblob.data+16, cli->secblob.length-16);
1002
1003         /* The server sent us the first part of the SPNEGO exchange in the
1004          * negprot reply. It is WRONG to depend on the principal sent in the
1005          * negprot reply, but right now we do it. If we don't receive one,
1006          * we try to best guess, then fall back to NTLM.  */
1007         if (!spnego_parse_negTokenInit(blob, OIDs, &principal)) {
1008                 data_blob_free(&blob);
1009                 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1010         }
1011         data_blob_free(&blob);
1012
1013         /* make sure the server understands kerberos */
1014         for (i=0;OIDs[i];i++) {
1015                 if (i == 0)
1016                         DEBUG(3,("got OID=%s\n", OIDs[i]));
1017                 else
1018                         DEBUGADD(3,("got OID=%s\n", OIDs[i]));
1019                 if (strcmp(OIDs[i], OID_KERBEROS5_OLD) == 0 ||
1020                     strcmp(OIDs[i], OID_KERBEROS5) == 0) {
1021                         cli->got_kerberos_mechanism = True;
1022                 }
1023                 talloc_free(OIDs[i]);
1024         }
1025
1026         DEBUG(3,("got principal=%s\n", principal ? principal : "<null>"));
1027
1028         status = cli_set_username(cli, user);
1029         if (!NT_STATUS_IS_OK(status)) {
1030                 return ADS_ERROR_NT(status);
1031         }
1032
1033 #ifdef HAVE_KRB5
1034         /* If password is set we reauthenticate to kerberos server
1035          * and do not store results */
1036
1037         if (cli->got_kerberos_mechanism && cli->use_kerberos) {
1038                 ADS_STATUS rc;
1039
1040                 if (pass && *pass) {
1041                         int ret;
1042
1043                         use_in_memory_ccache();
1044                         ret = kerberos_kinit_password(user, pass, 0 /* no time correction for now */, NULL);
1045
1046                         if (ret){
1047                                 TALLOC_FREE(principal);
1048                                 DEBUG(0, ("Kinit failed: %s\n", error_message(ret)));
1049                                 if (cli->fallback_after_kerberos)
1050                                         goto ntlmssp;
1051                                 return ADS_ERROR_KRB5(ret);
1052                         }
1053                 }
1054
1055                 /* If we get a bad principal, try to guess it if
1056                    we have a valid host NetBIOS name.
1057                  */
1058                 if (strequal(principal, ADS_IGNORE_PRINCIPAL)) {
1059                         TALLOC_FREE(principal);
1060                 }
1061
1062                 if (principal == NULL &&
1063                         !is_ipaddress(cli->desthost) &&
1064                         !strequal(STAR_SMBSERVER,
1065                                 cli->desthost)) {
1066                         char *realm = NULL;
1067                         char *machine = NULL;
1068                         char *host = NULL;
1069                         DEBUG(3,("cli_session_setup_spnego: got a "
1070                                 "bad server principal, trying to guess ...\n"));
1071
1072                         host = strchr_m(cli->desthost, '.');
1073                         if (host) {
1074                                 machine = SMB_STRNDUP(cli->desthost,
1075                                         host - cli->desthost);
1076                         } else {
1077                                 machine = SMB_STRDUP(cli->desthost);
1078                         }
1079                         if (machine == NULL) {
1080                                 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1081                         }
1082
1083                         if (dest_realm) {
1084                                 realm = SMB_STRDUP(dest_realm);
1085                                 strupper_m(realm);
1086                         } else {
1087                                 realm = kerberos_get_default_realm_from_ccache();
1088                         }
1089                         if (realm && *realm) {
1090                                 principal = talloc_asprintf(NULL, "%s$@%s",
1091                                                         machine, realm);
1092                                 if (!principal) {
1093                                         SAFE_FREE(machine);
1094                                         SAFE_FREE(realm);
1095                                         return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1096                                 }
1097                                 DEBUG(3,("cli_session_setup_spnego: guessed "
1098                                         "server principal=%s\n",
1099                                         principal ? principal : "<null>"));
1100                         }
1101                         SAFE_FREE(machine);
1102                         SAFE_FREE(realm);
1103                 }
1104
1105                 if (principal) {
1106                         rc = cli_session_setup_kerberos(cli, principal,
1107                                 dest_realm);
1108                         if (ADS_ERR_OK(rc) || !cli->fallback_after_kerberos) {
1109                                 TALLOC_FREE(principal);
1110                                 return rc;
1111                         }
1112                 }
1113         }
1114 #endif
1115
1116         TALLOC_FREE(principal);
1117
1118 ntlmssp:
1119
1120         account = talloc_strdup(talloc_tos(), user);
1121         if (!account) {
1122                 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1123         }
1124
1125         /* when falling back to ntlmssp while authenticating with a machine
1126          * account strip off the realm - gd */
1127
1128         if ((p = strchr_m(user, '@')) != NULL) {
1129                 account[PTR_DIFF(p,user)] = '\0';
1130         }
1131
1132         return ADS_ERROR_NT(cli_session_setup_ntlmssp(cli, account, pass, user_domain));
1133 }
1134
1135 /****************************************************************************
1136  Send a session setup. The username and workgroup is in UNIX character
1137  format and must be converted to DOS codepage format before sending. If the
1138  password is in plaintext, the same should be done.
1139 ****************************************************************************/
1140
1141 NTSTATUS cli_session_setup(struct cli_state *cli,
1142                            const char *user,
1143                            const char *pass, int passlen,
1144                            const char *ntpass, int ntpasslen,
1145                            const char *workgroup)
1146 {
1147         char *p;
1148         fstring user2;
1149
1150         if (user) {
1151                 fstrcpy(user2, user);
1152         } else {
1153                 user2[0] ='\0';
1154         }
1155
1156         if (!workgroup) {
1157                 workgroup = "";
1158         }
1159
1160         /* allow for workgroups as part of the username */
1161         if ((p=strchr_m(user2,'\\')) || (p=strchr_m(user2,'/')) ||
1162             (p=strchr_m(user2,*lp_winbind_separator()))) {
1163                 *p = 0;
1164                 user = p+1;
1165                 workgroup = user2;
1166         }
1167
1168         if (cli->protocol < PROTOCOL_LANMAN1) {
1169                 return NT_STATUS_OK;
1170         }
1171
1172         /* now work out what sort of session setup we are going to
1173            do. I have split this into separate functions to make the
1174            flow a bit easier to understand (tridge) */
1175
1176         /* if its an older server then we have to use the older request format */
1177
1178         if (cli->protocol < PROTOCOL_NT1) {
1179                 if (!lp_client_lanman_auth() && passlen != 24 && (*pass)) {
1180                         DEBUG(1, ("Server requested LM password but 'client lanman auth'"
1181                                   " is disabled\n"));
1182                         return NT_STATUS_ACCESS_DENIED;
1183                 }
1184
1185                 if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0 &&
1186                     !lp_client_plaintext_auth() && (*pass)) {
1187                         DEBUG(1, ("Server requested plaintext password but "
1188                                   "'client plaintext auth' is disabled\n"));
1189                         return NT_STATUS_ACCESS_DENIED;
1190                 }
1191
1192                 return cli_session_setup_lanman2(cli, user, pass, passlen,
1193                                                  workgroup);
1194         }
1195
1196         /* if no user is supplied then we have to do an anonymous connection.
1197            passwords are ignored */
1198
1199         if (!user || !*user)
1200                 return cli_session_setup_guest(cli);
1201
1202         /* if the server is share level then send a plaintext null
1203            password at this point. The password is sent in the tree
1204            connect */
1205
1206         if ((cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) == 0)
1207                 return cli_session_setup_plaintext(cli, user, "", workgroup);
1208
1209         /* if the server doesn't support encryption then we have to use
1210            plaintext. The second password is ignored */
1211
1212         if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0) {
1213                 if (!lp_client_plaintext_auth() && (*pass)) {
1214                         DEBUG(1, ("Server requested plaintext password but "
1215                                   "'client plaintext auth' is disabled\n"));
1216                         return NT_STATUS_ACCESS_DENIED;
1217                 }
1218                 return cli_session_setup_plaintext(cli, user, pass, workgroup);
1219         }
1220
1221         /* if the server supports extended security then use SPNEGO */
1222
1223         if (cli->capabilities & CAP_EXTENDED_SECURITY) {
1224                 ADS_STATUS status = cli_session_setup_spnego(cli, user, pass,
1225                                                              workgroup, NULL);
1226                 if (!ADS_ERR_OK(status)) {
1227                         DEBUG(3, ("SPNEGO login failed: %s\n", ads_errstr(status)));
1228                         return ads_ntstatus(status);
1229                 }
1230         } else {
1231                 NTSTATUS status;
1232
1233                 /* otherwise do a NT1 style session setup */
1234                 status = cli_session_setup_nt1(cli, user, pass, passlen,
1235                                                ntpass, ntpasslen, workgroup);
1236                 if (!NT_STATUS_IS_OK(status)) {
1237                         DEBUG(3,("cli_session_setup: NT1 session setup "
1238                                  "failed: %s\n", nt_errstr(status)));
1239                         return status;
1240                 }
1241         }
1242
1243         if (strstr(cli->server_type, "Samba")) {
1244                 cli->is_samba = True;
1245         }
1246
1247         return NT_STATUS_OK;
1248 }
1249
1250 /****************************************************************************
1251  Send a uloggoff.
1252 *****************************************************************************/
1253
1254 bool cli_ulogoff(struct cli_state *cli)
1255 {
1256         memset(cli->outbuf,'\0',smb_size);
1257         cli_set_message(cli->outbuf,2,0,True);
1258         SCVAL(cli->outbuf,smb_com,SMBulogoffX);
1259         cli_setup_packet(cli);
1260         SSVAL(cli->outbuf,smb_vwv0,0xFF);
1261         SSVAL(cli->outbuf,smb_vwv2,0);  /* no additional info */
1262
1263         cli_send_smb(cli);
1264         if (!cli_receive_smb(cli))
1265                 return False;
1266
1267         if (cli_is_error(cli)) {
1268                 return False;
1269         }
1270
1271         cli->vuid = -1;
1272         return True;
1273 }
1274
1275 /****************************************************************************
1276  Send a tconX.
1277 ****************************************************************************/
1278
1279 struct cli_tcon_andx_state {
1280         struct cli_state *cli;
1281         uint16_t vwv[4];
1282         struct iovec bytes;
1283 };
1284
1285 static void cli_tcon_andx_done(struct tevent_req *subreq);
1286
1287 struct tevent_req *cli_tcon_andx_create(TALLOC_CTX *mem_ctx,
1288                                         struct event_context *ev,
1289                                         struct cli_state *cli,
1290                                         const char *share, const char *dev,
1291                                         const char *pass, int passlen,
1292                                         struct tevent_req **psmbreq)
1293 {
1294         struct tevent_req *req, *subreq;
1295         struct cli_tcon_andx_state *state;
1296         fstring pword;
1297         uint16_t *vwv;
1298         char *tmp = NULL;
1299         uint8_t *bytes;
1300
1301         req = tevent_req_create(mem_ctx, &state, struct cli_tcon_andx_state);
1302         if (req == NULL) {
1303                 return NULL;
1304         }
1305         state->cli = cli;
1306         vwv = state->vwv;
1307
1308         fstrcpy(cli->share, share);
1309
1310         /* in user level security don't send a password now */
1311         if (cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) {
1312                 passlen = 1;
1313                 pass = "";
1314         } else if (pass == NULL) {
1315                 DEBUG(1, ("Server not using user level security and no "
1316                           "password supplied.\n"));
1317                 goto access_denied;
1318         }
1319
1320         if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) &&
1321             *pass && passlen != 24) {
1322                 if (!lp_client_lanman_auth()) {
1323                         DEBUG(1, ("Server requested LANMAN password "
1324                                   "(share-level security) but "
1325                                   "'client lanman auth' is disabled\n"));
1326                         goto access_denied;
1327                 }
1328
1329                 /*
1330                  * Non-encrypted passwords - convert to DOS codepage before
1331                  * encryption.
1332                  */
1333                 passlen = 24;
1334                 SMBencrypt(pass, cli->secblob.data, (uchar *)pword);
1335         } else {
1336                 if((cli->sec_mode & (NEGOTIATE_SECURITY_USER_LEVEL
1337                                      |NEGOTIATE_SECURITY_CHALLENGE_RESPONSE))
1338                    == 0) {
1339                         if (!lp_client_plaintext_auth() && (*pass)) {
1340                                 DEBUG(1, ("Server requested plaintext "
1341                                           "password but 'client plaintext "
1342                                           "auth' is disabled\n"));
1343                                 goto access_denied;
1344                         }
1345
1346                         /*
1347                          * Non-encrypted passwords - convert to DOS codepage
1348                          * before using.
1349                          */
1350                         passlen = clistr_push(cli, pword, pass, sizeof(pword),
1351                                               STR_TERMINATE);
1352                         if (passlen == -1) {
1353                                 DEBUG(1, ("clistr_push(pword) failed\n"));
1354                                 goto access_denied;
1355                         }
1356                 } else {
1357                         if (passlen) {
1358                                 memcpy(pword, pass, passlen);
1359                         }
1360                 }
1361         }
1362
1363         SCVAL(vwv+0, 0, 0xFF);
1364         SCVAL(vwv+0, 1, 0);
1365         SSVAL(vwv+1, 0, 0);
1366         SSVAL(vwv+2, 0, TCONX_FLAG_EXTENDED_RESPONSE);
1367         SSVAL(vwv+3, 0, passlen);
1368
1369         if (passlen) {
1370                 bytes = (uint8_t *)talloc_memdup(state, pword, passlen);
1371         } else {
1372                 bytes = talloc_array(state, uint8_t, 0);
1373         }
1374
1375         /*
1376          * Add the sharename
1377          */
1378         tmp = talloc_asprintf_strupper_m(talloc_tos(), "\\\\%s\\%s",
1379                                          cli->desthost, share);
1380         if (tmp == NULL) {
1381                 TALLOC_FREE(req);
1382                 return NULL;
1383         }
1384         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), tmp, strlen(tmp)+1,
1385                                    NULL);
1386         TALLOC_FREE(tmp);
1387
1388         /*
1389          * Add the devicetype
1390          */
1391         tmp = talloc_strdup_upper(talloc_tos(), dev);
1392         if (tmp == NULL) {
1393                 TALLOC_FREE(req);
1394                 return NULL;
1395         }
1396         bytes = smb_bytes_push_str(bytes, false, tmp, strlen(tmp)+1, NULL);
1397         TALLOC_FREE(tmp);
1398
1399         if (bytes == NULL) {
1400                 TALLOC_FREE(req);
1401                 return NULL;
1402         }
1403
1404         state->bytes.iov_base = (void *)bytes;
1405         state->bytes.iov_len = talloc_get_size(bytes);
1406
1407         subreq = cli_smb_req_create(state, ev, cli, SMBtconX, 0, 4, vwv,
1408                                     1, &state->bytes);
1409         if (subreq == NULL) {
1410                 TALLOC_FREE(req);
1411                 return NULL;
1412         }
1413         tevent_req_set_callback(subreq, cli_tcon_andx_done, req);
1414         *psmbreq = subreq;
1415         return req;
1416
1417  access_denied:
1418         tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1419         return tevent_req_post(req, ev);
1420 }
1421
1422 struct tevent_req *cli_tcon_andx_send(TALLOC_CTX *mem_ctx,
1423                                       struct event_context *ev,
1424                                       struct cli_state *cli,
1425                                       const char *share, const char *dev,
1426                                       const char *pass, int passlen)
1427 {
1428         struct tevent_req *req, *subreq;
1429         NTSTATUS status;
1430
1431         req = cli_tcon_andx_create(mem_ctx, ev, cli, share, dev, pass, passlen,
1432                                    &subreq);
1433         if (req == NULL) {
1434                 return NULL;
1435         }
1436         status = cli_smb_req_send(subreq);
1437         if (!NT_STATUS_IS_OK(status)) {
1438                 tevent_req_nterror(req, status);
1439                 return tevent_req_post(req, ev);
1440         }
1441         return req;
1442 }
1443
1444 static void cli_tcon_andx_done(struct tevent_req *subreq)
1445 {
1446         struct tevent_req *req = tevent_req_callback_data(
1447                 subreq, struct tevent_req);
1448         struct cli_tcon_andx_state *state = tevent_req_data(
1449                 req, struct cli_tcon_andx_state);
1450         struct cli_state *cli = state->cli;
1451         char *inbuf = (char *)cli_smb_inbuf(subreq);
1452         uint8_t wct;
1453         uint16_t *vwv;
1454         uint32_t num_bytes;
1455         uint8_t *bytes;
1456         NTSTATUS status;
1457
1458         status = cli_smb_recv(subreq, 0, &wct, &vwv, &num_bytes, &bytes);
1459         if (!NT_STATUS_IS_OK(status)) {
1460                 TALLOC_FREE(subreq);
1461                 tevent_req_nterror(req, status);
1462                 return;
1463         }
1464
1465         clistr_pull(inbuf, cli->dev, bytes, sizeof(fstring), num_bytes,
1466                     STR_TERMINATE|STR_ASCII);
1467
1468         if ((cli->protocol >= PROTOCOL_NT1) && (num_bytes == 3)) {
1469                 /* almost certainly win95 - enable bug fixes */
1470                 cli->win95 = True;
1471         }
1472
1473         /*
1474          * Make sure that we have the optional support 16-bit field. WCT > 2.
1475          * Avoids issues when connecting to Win9x boxes sharing files
1476          */
1477
1478         cli->dfsroot = false;
1479
1480         if ((wct > 2) && (cli->protocol >= PROTOCOL_LANMAN2)) {
1481                 cli->dfsroot = ((SVAL(vwv+2, 0) & SMB_SHARE_IN_DFS) != 0);
1482         }
1483
1484         cli->cnum = SVAL(inbuf,smb_tid);
1485         tevent_req_done(req);
1486 }
1487
1488 NTSTATUS cli_tcon_andx_recv(struct tevent_req *req)
1489 {
1490         return tevent_req_simple_recv_ntstatus(req);
1491 }
1492
1493 NTSTATUS cli_tcon_andx(struct cli_state *cli, const char *share,
1494                        const char *dev, const char *pass, int passlen)
1495 {
1496         TALLOC_CTX *frame = talloc_stackframe();
1497         struct event_context *ev;
1498         struct tevent_req *req;
1499         NTSTATUS status = NT_STATUS_OK;
1500
1501         if (cli_has_async_calls(cli)) {
1502                 /*
1503                  * Can't use sync call while an async call is in flight
1504                  */
1505                 status = NT_STATUS_INVALID_PARAMETER;
1506                 goto fail;
1507         }
1508
1509         ev = event_context_init(frame);
1510         if (ev == NULL) {
1511                 status = NT_STATUS_NO_MEMORY;
1512                 goto fail;
1513         }
1514
1515         req = cli_tcon_andx_send(frame, ev, cli, share, dev, pass, passlen);
1516         if (req == NULL) {
1517                 status = NT_STATUS_NO_MEMORY;
1518                 goto fail;
1519         }
1520
1521         if (!tevent_req_poll(req, ev)) {
1522                 status = map_nt_error_from_unix(errno);
1523                 goto fail;
1524         }
1525
1526         status = cli_tcon_andx_recv(req);
1527  fail:
1528         TALLOC_FREE(frame);
1529         if (!NT_STATUS_IS_OK(status)) {
1530                 cli_set_error(cli, status);
1531         }
1532         return status;
1533 }
1534
1535 /****************************************************************************
1536  Send a tree disconnect.
1537 ****************************************************************************/
1538
1539 bool cli_tdis(struct cli_state *cli)
1540 {
1541         memset(cli->outbuf,'\0',smb_size);
1542         cli_set_message(cli->outbuf,0,0,True);
1543         SCVAL(cli->outbuf,smb_com,SMBtdis);
1544         SSVAL(cli->outbuf,smb_tid,cli->cnum);
1545         cli_setup_packet(cli);
1546
1547         cli_send_smb(cli);
1548         if (!cli_receive_smb(cli))
1549                 return False;
1550
1551         if (cli_is_error(cli)) {
1552                 return False;
1553         }
1554
1555         cli->cnum = -1;
1556         return True;
1557 }
1558
1559 /****************************************************************************
1560  Send a negprot command.
1561 ****************************************************************************/
1562
1563 void cli_negprot_sendsync(struct cli_state *cli)
1564 {
1565         char *p;
1566         int numprots;
1567
1568         if (cli->protocol < PROTOCOL_NT1)
1569                 cli->use_spnego = False;
1570
1571         memset(cli->outbuf,'\0',smb_size);
1572
1573         /* setup the protocol strings */
1574         cli_set_message(cli->outbuf,0,0,True);
1575
1576         p = smb_buf(cli->outbuf);
1577         for (numprots=0; numprots < ARRAY_SIZE(prots); numprots++) {
1578                 if (prots[numprots].prot > cli->protocol) {
1579                         break;
1580                 }
1581                 *p++ = 2;
1582                 p += clistr_push(cli, p, prots[numprots].name, -1, STR_TERMINATE);
1583         }
1584
1585         SCVAL(cli->outbuf,smb_com,SMBnegprot);
1586         cli_setup_bcc(cli, p);
1587         cli_setup_packet(cli);
1588
1589         SCVAL(smb_buf(cli->outbuf),0,2);
1590
1591         cli_send_smb(cli);
1592 }
1593
1594 /****************************************************************************
1595  Send a negprot command.
1596 ****************************************************************************/
1597
1598 struct cli_negprot_state {
1599         struct cli_state *cli;
1600 };
1601
1602 static void cli_negprot_done(struct tevent_req *subreq);
1603
1604 struct tevent_req *cli_negprot_send(TALLOC_CTX *mem_ctx,
1605                                     struct event_context *ev,
1606                                     struct cli_state *cli)
1607 {
1608         struct tevent_req *req, *subreq;
1609         struct cli_negprot_state *state;
1610         uint8_t *bytes = NULL;
1611         int numprots;
1612         uint16_t cnum;
1613
1614         req = tevent_req_create(mem_ctx, &state, struct cli_negprot_state);
1615         if (req == NULL) {
1616                 return NULL;
1617         }
1618         state->cli = cli;
1619
1620         if (cli->protocol < PROTOCOL_NT1)
1621                 cli->use_spnego = False;
1622
1623         /* setup the protocol strings */
1624         for (numprots=0; numprots < ARRAY_SIZE(prots); numprots++) {
1625                 uint8_t c = 2;
1626                 if (prots[numprots].prot > cli->protocol) {
1627                         break;
1628                 }
1629                 bytes = (uint8_t *)talloc_append_blob(
1630                         state, bytes, data_blob_const(&c, sizeof(c)));
1631                 if (tevent_req_nomem(bytes, req)) {
1632                         return tevent_req_post(req, ev);
1633                 }
1634                 bytes = smb_bytes_push_str(bytes, false,
1635                                            prots[numprots].name,
1636                                            strlen(prots[numprots].name)+1,
1637                                            NULL);
1638                 if (tevent_req_nomem(bytes, req)) {
1639                         return tevent_req_post(req, ev);
1640                 }
1641         }
1642
1643         cnum = cli->cnum;
1644
1645         cli->cnum = 0;
1646         subreq = cli_smb_send(state, ev, cli, SMBnegprot, 0, 0, NULL,
1647                               talloc_get_size(bytes), bytes);
1648         cli->cnum = cnum;
1649
1650         if (tevent_req_nomem(subreq, req)) {
1651                 return tevent_req_post(req, ev);
1652         }
1653         tevent_req_set_callback(subreq, cli_negprot_done, req);
1654         return req;
1655 }
1656
1657 static void cli_negprot_done(struct tevent_req *subreq)
1658 {
1659         struct tevent_req *req = tevent_req_callback_data(
1660                 subreq, struct tevent_req);
1661         struct cli_negprot_state *state = tevent_req_data(
1662                 req, struct cli_negprot_state);
1663         struct cli_state *cli = state->cli;
1664         uint8_t wct;
1665         uint16_t *vwv;
1666         uint32_t num_bytes;
1667         uint8_t *bytes;
1668         NTSTATUS status;
1669         uint16_t protnum;
1670
1671         status = cli_smb_recv(subreq, 1, &wct, &vwv, &num_bytes, &bytes);
1672         if (!NT_STATUS_IS_OK(status)) {
1673                 TALLOC_FREE(subreq);
1674                 tevent_req_nterror(req, status);
1675                 return;
1676         }
1677
1678         protnum = SVAL(vwv, 0);
1679
1680         if ((protnum >= ARRAY_SIZE(prots))
1681             || (prots[protnum].prot > cli->protocol)) {
1682                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1683                 return;
1684         }
1685
1686         cli->protocol = prots[protnum].prot;
1687
1688         if ((cli->protocol < PROTOCOL_NT1) &&
1689             client_is_signing_mandatory(cli)) {
1690                 DEBUG(0,("cli_negprot: SMB signing is mandatory and the selected protocol level doesn't support it.\n"));
1691                 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1692                 return;
1693         }
1694
1695         if (cli->protocol >= PROTOCOL_NT1) {
1696                 struct timespec ts;
1697                 bool negotiated_smb_signing = false;
1698
1699                 /* NT protocol */
1700                 cli->sec_mode = CVAL(vwv + 1, 0);
1701                 cli->max_mux = SVAL(vwv + 1, 1);
1702                 cli->max_xmit = IVAL(vwv + 3, 1);
1703                 cli->sesskey = IVAL(vwv + 7, 1);
1704                 cli->serverzone = SVALS(vwv + 15, 1);
1705                 cli->serverzone *= 60;
1706                 /* this time arrives in real GMT */
1707                 ts = interpret_long_date(((char *)(vwv+11))+1);
1708                 cli->servertime = ts.tv_sec;
1709                 cli->secblob = data_blob(bytes, num_bytes);
1710                 cli->capabilities = IVAL(vwv + 9, 1);
1711                 if (cli->capabilities & CAP_RAW_MODE) {
1712                         cli->readbraw_supported = True;
1713                         cli->writebraw_supported = True;
1714                 }
1715                 /* work out if they sent us a workgroup */
1716                 if (!(cli->capabilities & CAP_EXTENDED_SECURITY) &&
1717                     smb_buflen(cli->inbuf) > 8) {
1718                         clistr_pull(cli->inbuf, cli->server_domain,
1719                                     bytes+8, sizeof(cli->server_domain),
1720                                     num_bytes-8,
1721                                     STR_UNICODE|STR_NOALIGN);
1722                 }
1723
1724                 /*
1725                  * As signing is slow we only turn it on if either the client or
1726                  * the server require it. JRA.
1727                  */
1728
1729                 if (cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED) {
1730                         /* Fail if server says signing is mandatory and we don't want to support it. */
1731                         if (!client_is_signing_allowed(cli)) {
1732                                 DEBUG(0,("cli_negprot: SMB signing is mandatory and we have disabled it.\n"));
1733                                 tevent_req_nterror(req,
1734                                                    NT_STATUS_ACCESS_DENIED);
1735                                 return;
1736                         }
1737                         negotiated_smb_signing = true;
1738                 } else if (client_is_signing_mandatory(cli) && client_is_signing_allowed(cli)) {
1739                         /* Fail if client says signing is mandatory and the server doesn't support it. */
1740                         if (!(cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED)) {
1741                                 DEBUG(1,("cli_negprot: SMB signing is mandatory and the server doesn't support it.\n"));
1742                                 tevent_req_nterror(req,
1743                                                    NT_STATUS_ACCESS_DENIED);
1744                                 return;
1745                         }
1746                         negotiated_smb_signing = true;
1747                 } else if (cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED) {
1748                         negotiated_smb_signing = true;
1749                 }
1750
1751                 if (negotiated_smb_signing) {
1752                         cli_set_signing_negotiated(cli);
1753                 }
1754
1755                 if (cli->capabilities & (CAP_LARGE_READX|CAP_LARGE_WRITEX)) {
1756                         SAFE_FREE(cli->outbuf);
1757                         SAFE_FREE(cli->inbuf);
1758                         cli->outbuf = (char *)SMB_MALLOC(CLI_SAMBA_MAX_LARGE_READX_SIZE+LARGE_WRITEX_HDR_SIZE+SAFETY_MARGIN);
1759                         cli->inbuf = (char *)SMB_MALLOC(CLI_SAMBA_MAX_LARGE_READX_SIZE+LARGE_WRITEX_HDR_SIZE+SAFETY_MARGIN);
1760                         cli->bufsize = CLI_SAMBA_MAX_LARGE_READX_SIZE + LARGE_WRITEX_HDR_SIZE;
1761                 }
1762
1763         } else if (cli->protocol >= PROTOCOL_LANMAN1) {
1764                 cli->use_spnego = False;
1765                 cli->sec_mode = SVAL(vwv + 1, 0);
1766                 cli->max_xmit = SVAL(vwv + 2, 0);
1767                 cli->max_mux = SVAL(vwv + 3, 0);
1768                 cli->sesskey = IVAL(vwv + 6, 0);
1769                 cli->serverzone = SVALS(vwv + 10, 0);
1770                 cli->serverzone *= 60;
1771                 /* this time is converted to GMT by make_unix_date */
1772                 cli->servertime = cli_make_unix_date(
1773                         cli, (char *)(vwv + 8));
1774                 cli->readbraw_supported = ((SVAL(vwv + 5, 0) & 0x1) != 0);
1775                 cli->writebraw_supported = ((SVAL(vwv + 5, 0) & 0x2) != 0);
1776                 cli->secblob = data_blob(bytes, num_bytes);
1777         } else {
1778                 /* the old core protocol */
1779                 cli->use_spnego = False;
1780                 cli->sec_mode = 0;
1781                 cli->serverzone = get_time_zone(time(NULL));
1782         }
1783
1784         cli->max_xmit = MIN(cli->max_xmit, CLI_BUFFER_SIZE);
1785
1786         /* a way to force ascii SMB */
1787         if (getenv("CLI_FORCE_ASCII"))
1788                 cli->capabilities &= ~CAP_UNICODE;
1789
1790         tevent_req_done(req);
1791 }
1792
1793 NTSTATUS cli_negprot_recv(struct tevent_req *req)
1794 {
1795         return tevent_req_simple_recv_ntstatus(req);
1796 }
1797
1798 NTSTATUS cli_negprot(struct cli_state *cli)
1799 {
1800         TALLOC_CTX *frame = talloc_stackframe();
1801         struct event_context *ev;
1802         struct tevent_req *req;
1803         NTSTATUS status = NT_STATUS_OK;
1804
1805         if (cli_has_async_calls(cli)) {
1806                 /*
1807                  * Can't use sync call while an async call is in flight
1808                  */
1809                 status = NT_STATUS_INVALID_PARAMETER;
1810                 goto fail;
1811         }
1812
1813         ev = event_context_init(frame);
1814         if (ev == NULL) {
1815                 status = NT_STATUS_NO_MEMORY;
1816                 goto fail;
1817         }
1818
1819         req = cli_negprot_send(frame, ev, cli);
1820         if (req == NULL) {
1821                 status = NT_STATUS_NO_MEMORY;
1822                 goto fail;
1823         }
1824
1825         if (!tevent_req_poll(req, ev)) {
1826                 status = map_nt_error_from_unix(errno);
1827                 goto fail;
1828         }
1829
1830         status = cli_negprot_recv(req);
1831  fail:
1832         TALLOC_FREE(frame);
1833         if (!NT_STATUS_IS_OK(status)) {
1834                 cli_set_error(cli, status);
1835         }
1836         return status;
1837 }
1838
1839 /****************************************************************************
1840  Send a session request. See rfc1002.txt 4.3 and 4.3.2.
1841 ****************************************************************************/
1842
1843 bool cli_session_request(struct cli_state *cli,
1844                          struct nmb_name *calling, struct nmb_name *called)
1845 {
1846         char *p;
1847         int len = 4;
1848         char *tmp;
1849
1850         /* 445 doesn't have session request */
1851         if (cli->port == 445)
1852                 return True;
1853
1854         memcpy(&(cli->calling), calling, sizeof(*calling));
1855         memcpy(&(cli->called ), called , sizeof(*called ));
1856
1857         /* put in the destination name */
1858
1859         tmp = name_mangle(talloc_tos(), cli->called.name,
1860                           cli->called.name_type);
1861         if (tmp == NULL) {
1862                 return false;
1863         }
1864
1865         p = cli->outbuf+len;
1866         memcpy(p, tmp, name_len(tmp));
1867         len += name_len(tmp);
1868         TALLOC_FREE(tmp);
1869
1870         /* and my name */
1871
1872         tmp = name_mangle(talloc_tos(), cli->calling.name,
1873                           cli->calling.name_type);
1874         if (tmp == NULL) {
1875                 return false;
1876         }
1877
1878         p = cli->outbuf+len;
1879         memcpy(p, tmp, name_len(tmp));
1880         len += name_len(tmp);
1881         TALLOC_FREE(tmp);
1882
1883         /* send a session request (RFC 1002) */
1884         /* setup the packet length
1885          * Remove four bytes from the length count, since the length
1886          * field in the NBT Session Service header counts the number
1887          * of bytes which follow.  The cli_send_smb() function knows
1888          * about this and accounts for those four bytes.
1889          * CRH.
1890          */
1891         len -= 4;
1892         _smb_setlen(cli->outbuf,len);
1893         SCVAL(cli->outbuf,0,0x81);
1894
1895         cli_send_smb(cli);
1896         DEBUG(5,("Sent session request\n"));
1897
1898         if (!cli_receive_smb(cli))
1899                 return False;
1900
1901         if (CVAL(cli->inbuf,0) == 0x84) {
1902                 /* C. Hoch  9/14/95 Start */
1903                 /* For information, here is the response structure.
1904                  * We do the byte-twiddling to for portability.
1905                 struct RetargetResponse{
1906                 unsigned char type;
1907                 unsigned char flags;
1908                 int16 length;
1909                 int32 ip_addr;
1910                 int16 port;
1911                 };
1912                 */
1913                 uint16_t port = (CVAL(cli->inbuf,8)<<8)+CVAL(cli->inbuf,9);
1914                 struct in_addr dest_ip;
1915                 NTSTATUS status;
1916
1917                 /* SESSION RETARGET */
1918                 putip((char *)&dest_ip,cli->inbuf+4);
1919                 in_addr_to_sockaddr_storage(&cli->dest_ss, dest_ip);
1920
1921                 status = open_socket_out(&cli->dest_ss, port,
1922                                          LONG_CONNECT_TIMEOUT, &cli->fd);
1923                 if (!NT_STATUS_IS_OK(status)) {
1924                         return False;
1925                 }
1926
1927                 DEBUG(3,("Retargeted\n"));
1928
1929                 set_socket_options(cli->fd, lp_socket_options());
1930
1931                 /* Try again */
1932                 {
1933                         static int depth;
1934                         bool ret;
1935                         if (depth > 4) {
1936                                 DEBUG(0,("Retarget recursion - failing\n"));
1937                                 return False;
1938                         }
1939                         depth++;
1940                         ret = cli_session_request(cli, calling, called);
1941                         depth--;
1942                         return ret;
1943                 }
1944         } /* C. Hoch 9/14/95 End */
1945
1946         if (CVAL(cli->inbuf,0) != 0x82) {
1947                 /* This is the wrong place to put the error... JRA. */
1948                 cli->rap_error = CVAL(cli->inbuf,4);
1949                 return False;
1950         }
1951         return(True);
1952 }
1953
1954 struct fd_struct {
1955         int fd;
1956 };
1957
1958 static void smb_sock_connected(struct tevent_req *req)
1959 {
1960         struct fd_struct *pfd = tevent_req_callback_data(
1961                 req, struct fd_struct);
1962         int fd;
1963         NTSTATUS status;
1964
1965         status = open_socket_out_defer_recv(req, &fd);
1966         if (NT_STATUS_IS_OK(status)) {
1967                 pfd->fd = fd;
1968         }
1969 }
1970
1971 static NTSTATUS open_smb_socket(const struct sockaddr_storage *pss,
1972                                 uint16_t *port, int timeout, int *pfd)
1973 {
1974         struct event_context *ev;
1975         struct tevent_req *r139, *r445;
1976         struct fd_struct *fd139, *fd445;
1977         NTSTATUS status = NT_STATUS_NO_MEMORY;
1978
1979         if (*port != 0) {
1980                 return open_socket_out(pss, *port, timeout, pfd);
1981         }
1982
1983         ev = event_context_init(talloc_tos());
1984         if (ev == NULL) {
1985                 return NT_STATUS_NO_MEMORY;
1986         }
1987
1988         fd139 = talloc(ev, struct fd_struct);
1989         if (fd139 == NULL) {
1990                 goto done;
1991         }
1992         fd139->fd = -1;
1993
1994         fd445 = talloc(ev, struct fd_struct);
1995         if (fd445 == NULL) {
1996                 goto done;
1997         }
1998         fd445->fd = -1;
1999
2000         r445 = open_socket_out_defer_send(ev, ev, timeval_set(0, 0),
2001                                           pss, 445, timeout);
2002         r139 = open_socket_out_defer_send(ev, ev, timeval_set(0, 3000),
2003                                           pss, 139, timeout);
2004         if ((r445 == NULL) || (r139 == NULL)) {
2005                 goto done;
2006         }
2007         tevent_req_set_callback(r445, smb_sock_connected, fd445);
2008         tevent_req_set_callback(r139, smb_sock_connected, fd139);
2009
2010         while ((fd445->fd == -1) && (fd139->fd == -1)
2011                && (tevent_req_is_in_progress(r139)
2012                    || tevent_req_is_in_progress(r445))) {
2013                 event_loop_once(ev);
2014         }
2015
2016         if ((fd139->fd != -1) && (fd445->fd != -1)) {
2017                 close(fd139->fd);
2018                 fd139->fd = -1;
2019         }
2020
2021         if (fd445->fd != -1) {
2022                 *port = 445;
2023                 *pfd = fd445->fd;
2024                 status = NT_STATUS_OK;
2025                 goto done;
2026         }
2027         if (fd139->fd != -1) {
2028                 *port = 139;
2029                 *pfd = fd139->fd;
2030                 status = NT_STATUS_OK;
2031                 goto done;
2032         }
2033
2034         status = open_socket_out_defer_recv(r445, &fd445->fd);
2035  done:
2036         TALLOC_FREE(ev);
2037         return status;
2038 }
2039
2040 /****************************************************************************
2041  Open the client sockets.
2042 ****************************************************************************/
2043
2044 NTSTATUS cli_connect(struct cli_state *cli,
2045                 const char *host,
2046                 struct sockaddr_storage *dest_ss)
2047
2048 {
2049         int name_type = 0x20;
2050         TALLOC_CTX *frame = talloc_stackframe();
2051         unsigned int num_addrs = 0;
2052         unsigned int i = 0;
2053         struct sockaddr_storage *ss_arr = NULL;
2054         char *p = NULL;
2055
2056         /* reasonable default hostname */
2057         if (!host) {
2058                 host = STAR_SMBSERVER;
2059         }
2060
2061         fstrcpy(cli->desthost, host);
2062
2063         /* allow hostnames of the form NAME#xx and do a netbios lookup */
2064         if ((p = strchr(cli->desthost, '#'))) {
2065                 name_type = strtol(p+1, NULL, 16);
2066                 *p = 0;
2067         }
2068
2069         if (!dest_ss || is_zero_addr((struct sockaddr *)dest_ss)) {
2070                 NTSTATUS status =resolve_name_list(frame,
2071                                         cli->desthost,
2072                                         name_type,
2073                                         &ss_arr,
2074                                         &num_addrs);
2075                 if (!NT_STATUS_IS_OK(status)) {
2076                         TALLOC_FREE(frame);
2077                         return NT_STATUS_BAD_NETWORK_NAME;
2078                 }
2079         } else {
2080                 num_addrs = 1;
2081                 ss_arr = TALLOC_P(frame, struct sockaddr_storage);
2082                 if (!ss_arr) {
2083                         TALLOC_FREE(frame);
2084                         return NT_STATUS_NO_MEMORY;
2085                 }
2086                 *ss_arr = *dest_ss;
2087         }
2088
2089         for (i = 0; i < num_addrs; i++) {
2090                 cli->dest_ss = ss_arr[i];
2091                 if (getenv("LIBSMB_PROG")) {
2092                         cli->fd = sock_exec(getenv("LIBSMB_PROG"));
2093                 } else {
2094                         uint16_t port = cli->port;
2095                         NTSTATUS status;
2096                         status = open_smb_socket(&cli->dest_ss, &port,
2097                                                  cli->timeout, &cli->fd);
2098                         if (NT_STATUS_IS_OK(status)) {
2099                                 cli->port = port;
2100                         }
2101                 }
2102                 if (cli->fd == -1) {
2103                         char addr[INET6_ADDRSTRLEN];
2104                         print_sockaddr(addr, sizeof(addr), &ss_arr[i]);
2105                         DEBUG(2,("Error connecting to %s (%s)\n",
2106                                  dest_ss?addr:host,strerror(errno)));
2107                 } else {
2108                         /* Exit from loop on first connection. */
2109                         break;
2110                 }
2111         }
2112
2113         if (cli->fd == -1) {
2114                 TALLOC_FREE(frame);
2115                 return map_nt_error_from_unix(errno);
2116         }
2117
2118         if (dest_ss) {
2119                 *dest_ss = cli->dest_ss;
2120         }
2121
2122         set_socket_options(cli->fd, lp_socket_options());
2123
2124         TALLOC_FREE(frame);
2125         return NT_STATUS_OK;
2126 }
2127
2128 /**
2129    establishes a connection to after the negprot.
2130    @param output_cli A fully initialised cli structure, non-null only on success
2131    @param dest_host The netbios name of the remote host
2132    @param dest_ss (optional) The the destination IP, NULL for name based lookup
2133    @param port (optional) The destination port (0 for default)
2134    @param retry bool. Did this connection fail with a retryable error ?
2135
2136 */
2137 NTSTATUS cli_start_connection(struct cli_state **output_cli,
2138                               const char *my_name,
2139                               const char *dest_host,
2140                               struct sockaddr_storage *dest_ss, int port,
2141                               int signing_state, int flags,
2142                               bool *retry)
2143 {
2144         NTSTATUS nt_status;
2145         struct nmb_name calling;
2146         struct nmb_name called;
2147         struct cli_state *cli;
2148         struct sockaddr_storage ss;
2149
2150         if (retry)
2151                 *retry = False;
2152
2153         if (!my_name)
2154                 my_name = global_myname();
2155
2156         if (!(cli = cli_initialise_ex(signing_state))) {
2157                 return NT_STATUS_NO_MEMORY;
2158         }
2159
2160         make_nmb_name(&calling, my_name, 0x0);
2161         make_nmb_name(&called , dest_host, 0x20);
2162
2163         cli_set_port(cli, port);
2164         cli_set_timeout(cli, 10000); /* 10 seconds. */
2165
2166         if (dest_ss) {
2167                 ss = *dest_ss;
2168         } else {
2169                 zero_sockaddr(&ss);
2170         }
2171
2172 again:
2173
2174         DEBUG(3,("Connecting to host=%s\n", dest_host));
2175
2176         nt_status = cli_connect(cli, dest_host, &ss);
2177         if (!NT_STATUS_IS_OK(nt_status)) {
2178                 char addr[INET6_ADDRSTRLEN];
2179                 print_sockaddr(addr, sizeof(addr), &ss);
2180                 DEBUG(1,("cli_start_connection: failed to connect to %s (%s). Error %s\n",
2181                          nmb_namestr(&called), addr, nt_errstr(nt_status) ));
2182                 cli_shutdown(cli);
2183                 return nt_status;
2184         }
2185
2186         if (retry)
2187                 *retry = True;
2188
2189         if (!cli_session_request(cli, &calling, &called)) {
2190                 char *p;
2191                 DEBUG(1,("session request to %s failed (%s)\n",
2192                          called.name, cli_errstr(cli)));
2193                 if ((p=strchr(called.name, '.')) && !is_ipaddress(called.name)) {
2194                         *p = 0;
2195                         goto again;
2196                 }
2197                 if (strcmp(called.name, STAR_SMBSERVER)) {
2198                         make_nmb_name(&called , STAR_SMBSERVER, 0x20);
2199                         goto again;
2200                 }
2201                 return NT_STATUS_BAD_NETWORK_NAME;
2202         }
2203
2204         if (flags & CLI_FULL_CONNECTION_DONT_SPNEGO)
2205                 cli->use_spnego = False;
2206         else if (flags & CLI_FULL_CONNECTION_USE_KERBEROS)
2207                 cli->use_kerberos = True;
2208
2209         if ((flags & CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS) &&
2210              cli->use_kerberos) {
2211                 cli->fallback_after_kerberos = true;
2212         }
2213
2214         nt_status = cli_negprot(cli);
2215         if (!NT_STATUS_IS_OK(nt_status)) {
2216                 DEBUG(1, ("failed negprot: %s\n", nt_errstr(nt_status)));
2217                 cli_shutdown(cli);
2218                 return nt_status;
2219         }
2220
2221         *output_cli = cli;
2222         return NT_STATUS_OK;
2223 }
2224
2225
2226 /**
2227    establishes a connection right up to doing tconX, password specified.
2228    @param output_cli A fully initialised cli structure, non-null only on success
2229    @param dest_host The netbios name of the remote host
2230    @param dest_ip (optional) The the destination IP, NULL for name based lookup
2231    @param port (optional) The destination port (0 for default)
2232    @param service (optional) The share to make the connection to.  Should be 'unqualified' in any way.
2233    @param service_type The 'type' of serivice.
2234    @param user Username, unix string
2235    @param domain User's domain
2236    @param password User's password, unencrypted unix string.
2237    @param retry bool. Did this connection fail with a retryable error ?
2238 */
2239
2240 NTSTATUS cli_full_connection(struct cli_state **output_cli,
2241                              const char *my_name,
2242                              const char *dest_host,
2243                              struct sockaddr_storage *dest_ss, int port,
2244                              const char *service, const char *service_type,
2245                              const char *user, const char *domain,
2246                              const char *password, int flags,
2247                              int signing_state,
2248                              bool *retry)
2249 {
2250         NTSTATUS nt_status;
2251         struct cli_state *cli = NULL;
2252         int pw_len = password ? strlen(password)+1 : 0;
2253
2254         *output_cli = NULL;
2255
2256         if (password == NULL) {
2257                 password = "";
2258         }
2259
2260         nt_status = cli_start_connection(&cli, my_name, dest_host,
2261                                          dest_ss, port, signing_state,
2262                                          flags, retry);
2263
2264         if (!NT_STATUS_IS_OK(nt_status)) {
2265                 return nt_status;
2266         }
2267
2268         cli->use_oplocks = ((flags & CLI_FULL_CONNECTION_OPLOCKS) != 0);
2269         cli->use_level_II_oplocks =
2270                 ((flags & CLI_FULL_CONNECTION_LEVEL_II_OPLOCKS) != 0);
2271
2272         nt_status = cli_session_setup(cli, user, password, pw_len, password,
2273                                       pw_len, domain);
2274         if (!NT_STATUS_IS_OK(nt_status)) {
2275
2276                 if (!(flags & CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK)) {
2277                         DEBUG(1,("failed session setup with %s\n",
2278                                  nt_errstr(nt_status)));
2279                         cli_shutdown(cli);
2280                         return nt_status;
2281                 }
2282
2283                 nt_status = cli_session_setup(cli, "", "", 0, "", 0, domain);
2284                 if (!NT_STATUS_IS_OK(nt_status)) {
2285                         DEBUG(1,("anonymous failed session setup with %s\n",
2286                                  nt_errstr(nt_status)));
2287                         cli_shutdown(cli);
2288                         return nt_status;
2289                 }
2290         }
2291
2292         if (service) {
2293                 nt_status = cli_tcon_andx(cli, service, service_type, password,
2294                                           pw_len);
2295                 if (!NT_STATUS_IS_OK(nt_status)) {
2296                         DEBUG(1,("failed tcon_X with %s\n", nt_errstr(nt_status)));
2297                         cli_shutdown(cli);
2298                         if (NT_STATUS_IS_OK(nt_status)) {
2299                                 nt_status = NT_STATUS_UNSUCCESSFUL;
2300                         }
2301                         return nt_status;
2302                 }
2303         }
2304
2305         nt_status = cli_init_creds(cli, user, domain, password);
2306         if (!NT_STATUS_IS_OK(nt_status)) {
2307                 cli_shutdown(cli);
2308                 return nt_status;
2309         }
2310
2311         *output_cli = cli;
2312         return NT_STATUS_OK;
2313 }
2314
2315 /****************************************************************************
2316  Attempt a NetBIOS session request, falling back to *SMBSERVER if needed.
2317 ****************************************************************************/
2318
2319 bool attempt_netbios_session_request(struct cli_state **ppcli, const char *srchost, const char *desthost,
2320                                      struct sockaddr_storage *pdest_ss)
2321 {
2322         struct nmb_name calling, called;
2323
2324         make_nmb_name(&calling, srchost, 0x0);
2325
2326         /*
2327          * If the called name is an IP address
2328          * then use *SMBSERVER immediately.
2329          */
2330
2331         if(is_ipaddress(desthost)) {
2332                 make_nmb_name(&called, STAR_SMBSERVER, 0x20);
2333         } else {
2334                 make_nmb_name(&called, desthost, 0x20);
2335         }
2336
2337         if (!cli_session_request(*ppcli, &calling, &called)) {
2338                 NTSTATUS status;
2339                 struct nmb_name smbservername;
2340
2341                 make_nmb_name(&smbservername, STAR_SMBSERVER, 0x20);
2342
2343                 /*
2344                  * If the name wasn't *SMBSERVER then
2345                  * try with *SMBSERVER if the first name fails.
2346                  */
2347
2348                 if (nmb_name_equal(&called, &smbservername)) {
2349
2350                         /*
2351                          * The name used was *SMBSERVER, don't bother with another name.
2352                          */
2353
2354                         DEBUG(0,("attempt_netbios_session_request: %s rejected the session for name *SMBSERVER \
2355 with error %s.\n", desthost, cli_errstr(*ppcli) ));
2356                         return False;
2357                 }
2358
2359                 /* Try again... */
2360                 cli_shutdown(*ppcli);
2361
2362                 *ppcli = cli_initialise();
2363                 if (!*ppcli) {
2364                         /* Out of memory... */
2365                         return False;
2366                 }
2367
2368                 status = cli_connect(*ppcli, desthost, pdest_ss);
2369                 if (!NT_STATUS_IS_OK(status) ||
2370                                 !cli_session_request(*ppcli, &calling, &smbservername)) {
2371                         DEBUG(0,("attempt_netbios_session_request: %s rejected the session for \
2372 name *SMBSERVER with error %s\n", desthost, cli_errstr(*ppcli) ));
2373                         return False;
2374                 }
2375         }
2376
2377         return True;
2378 }
2379
2380 /****************************************************************************
2381  Send an old style tcon.
2382 ****************************************************************************/
2383 NTSTATUS cli_raw_tcon(struct cli_state *cli,
2384                       const char *service, const char *pass, const char *dev,
2385                       uint16 *max_xmit, uint16 *tid)
2386 {
2387         char *p;
2388
2389         if (!lp_client_plaintext_auth() && (*pass)) {
2390                 DEBUG(1, ("Server requested plaintext password but 'client "
2391                           "plaintext auth' is disabled\n"));
2392                 return NT_STATUS_ACCESS_DENIED;
2393         }
2394
2395         memset(cli->outbuf,'\0',smb_size);
2396         memset(cli->inbuf,'\0',smb_size);
2397
2398         cli_set_message(cli->outbuf, 0, 0, True);
2399         SCVAL(cli->outbuf,smb_com,SMBtcon);
2400         cli_setup_packet(cli);
2401
2402         p = smb_buf(cli->outbuf);
2403         *p++ = 4; p += clistr_push(cli, p, service, -1, STR_TERMINATE | STR_NOALIGN);
2404         *p++ = 4; p += clistr_push(cli, p, pass, -1, STR_TERMINATE | STR_NOALIGN);
2405         *p++ = 4; p += clistr_push(cli, p, dev, -1, STR_TERMINATE | STR_NOALIGN);
2406
2407         cli_setup_bcc(cli, p);
2408
2409         cli_send_smb(cli);
2410         if (!cli_receive_smb(cli)) {
2411                 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
2412         }
2413
2414         if (cli_is_error(cli)) {
2415                 return cli_nt_error(cli);
2416         }
2417
2418         *max_xmit = SVAL(cli->inbuf, smb_vwv0);
2419         *tid = SVAL(cli->inbuf, smb_vwv1);
2420
2421         return NT_STATUS_OK;
2422 }
2423
2424 /* Return a cli_state pointing at the IPC$ share for the given server */
2425
2426 struct cli_state *get_ipc_connect(char *server,
2427                                 struct sockaddr_storage *server_ss,
2428                                 const struct user_auth_info *user_info)
2429 {
2430         struct cli_state *cli;
2431         NTSTATUS nt_status;
2432         uint32_t flags = CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK;
2433
2434         if (user_info->use_kerberos) {
2435                 flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
2436         }
2437
2438         nt_status = cli_full_connection(&cli, NULL, server, server_ss, 0, "IPC$", "IPC",
2439                                         user_info->username ? user_info->username : "",
2440                                         lp_workgroup(),
2441                                         user_info->password ? user_info->password : "",
2442                                         flags,
2443                                         Undefined, NULL);
2444
2445         if (NT_STATUS_IS_OK(nt_status)) {
2446                 return cli;
2447         } else if (is_ipaddress(server)) {
2448             /* windows 9* needs a correct NMB name for connections */
2449             fstring remote_name;
2450
2451             if (name_status_find("*", 0, 0, server_ss, remote_name)) {
2452                 cli = get_ipc_connect(remote_name, server_ss, user_info);
2453                 if (cli)
2454                     return cli;
2455             }
2456         }
2457         return NULL;
2458 }
2459
2460 /*
2461  * Given the IP address of a master browser on the network, return its
2462  * workgroup and connect to it.
2463  *
2464  * This function is provided to allow additional processing beyond what
2465  * get_ipc_connect_master_ip_bcast() does, e.g. to retrieve the list of master
2466  * browsers and obtain each master browsers' list of domains (in case the
2467  * first master browser is recently on the network and has not yet
2468  * synchronized with other master browsers and therefore does not yet have the
2469  * entire network browse list)
2470  */
2471
2472 struct cli_state *get_ipc_connect_master_ip(TALLOC_CTX *ctx,
2473                                 struct ip_service *mb_ip,
2474                                 const struct user_auth_info *user_info,
2475                                 char **pp_workgroup_out)
2476 {
2477         char addr[INET6_ADDRSTRLEN];
2478         fstring name;
2479         struct cli_state *cli;
2480         struct sockaddr_storage server_ss;
2481
2482         *pp_workgroup_out = NULL;
2483
2484         print_sockaddr(addr, sizeof(addr), &mb_ip->ss);
2485         DEBUG(99, ("Looking up name of master browser %s\n",
2486                    addr));
2487
2488         /*
2489          * Do a name status query to find out the name of the master browser.
2490          * We use <01><02>__MSBROWSE__<02>#01 if *#00 fails because a domain
2491          * master browser will not respond to a wildcard query (or, at least,
2492          * an NT4 server acting as the domain master browser will not).
2493          *
2494          * We might be able to use ONLY the query on MSBROWSE, but that's not
2495          * yet been tested with all Windows versions, so until it is, leave
2496          * the original wildcard query as the first choice and fall back to
2497          * MSBROWSE if the wildcard query fails.
2498          */
2499         if (!name_status_find("*", 0, 0x1d, &mb_ip->ss, name) &&
2500             !name_status_find(MSBROWSE, 1, 0x1d, &mb_ip->ss, name)) {
2501
2502                 DEBUG(99, ("Could not retrieve name status for %s\n",
2503                            addr));
2504                 return NULL;
2505         }
2506
2507         if (!find_master_ip(name, &server_ss)) {
2508                 DEBUG(99, ("Could not find master ip for %s\n", name));
2509                 return NULL;
2510         }
2511
2512         *pp_workgroup_out = talloc_strdup(ctx, name);
2513
2514         DEBUG(4, ("found master browser %s, %s\n", name, addr));
2515
2516         print_sockaddr(addr, sizeof(addr), &server_ss);
2517         cli = get_ipc_connect(addr, &server_ss, user_info);
2518
2519         return cli;
2520 }
2521
2522 /*
2523  * Return the IP address and workgroup of a master browser on the network, and
2524  * connect to it.
2525  */
2526
2527 struct cli_state *get_ipc_connect_master_ip_bcast(TALLOC_CTX *ctx,
2528                                         const struct user_auth_info *user_info,
2529                                         char **pp_workgroup_out)
2530 {
2531         struct ip_service *ip_list;
2532         struct cli_state *cli;
2533         int i, count;
2534
2535         *pp_workgroup_out = NULL;
2536
2537         DEBUG(99, ("Do broadcast lookup for workgroups on local network\n"));
2538
2539         /* Go looking for workgroups by broadcasting on the local network */
2540
2541         if (!NT_STATUS_IS_OK(name_resolve_bcast(MSBROWSE, 1, &ip_list,
2542                                                 &count))) {
2543                 DEBUG(99, ("No master browsers responded\n"));
2544                 return False;
2545         }
2546
2547         for (i = 0; i < count; i++) {
2548                 char addr[INET6_ADDRSTRLEN];
2549                 print_sockaddr(addr, sizeof(addr), &ip_list[i].ss);
2550                 DEBUG(99, ("Found master browser %s\n", addr));
2551
2552                 cli = get_ipc_connect_master_ip(ctx, &ip_list[i],
2553                                 user_info, pp_workgroup_out);
2554                 if (cli)
2555                         return(cli);
2556         }
2557
2558         return NULL;
2559 }