source3/libsmb/clidfs.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    client connect/disconnect routines
   4    Copyright (C) Andrew Tridgell                  1994-1998
   5    Copyright (C) Gerald (Jerry) Carter            2004
   6    Copyright (C) Jeremy Allison                   2007
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23
  24 /********************************************************************
  25  Important point.
  26
  27  DFS paths are *always* of the form \server\share\<pathname> (the \ characters
  28  are not C escaped here).
  29
  30  - but if we're using POSIX paths then <pathname> may contain
  31    '/' separators, not '\\' separators. So cope with '\\' or '/'
  32    as a separator when looking at the pathname part.... JRA.
  33 ********************************************************************/
  34
  35 struct client_connection {
  36         struct client_connection *prev, *next;
  37         struct cli_state *cli;
  38         char *mount;
  39 };
  40
  41 static struct cm_cred_struct {
  42         char *username;
  43         char *password;
  44         bool got_pass;
  45         bool use_kerberos;
  46         bool fallback_after_kerberos;
  47         int signing_state;
  48 } cm_creds;
  49
  50 static void cm_set_password(const char *newpass);
  51
  52 static int port;
  53 static int name_type = 0x20;
  54
  55 static struct client_connection *connections;
  56
  57 static bool cli_check_msdfs_proxy(TALLOC_CTX *ctx,
  58                                 struct cli_state *cli,
  59                                 const char *sharename,
  60                                 char **pp_newserver,
  61                                 char **pp_newshare,
  62                                 bool force_encrypt,
  63                                 const char *username,
  64                                 const char *password,
  65                                 const char *domain);
  66
  67 /********************************************************************
  68  Ensure a connection is encrypted.
  69 ********************************************************************/
  70
  71 NTSTATUS cli_cm_force_encryption(struct cli_state *c,
  72                         const char *username,
  73                         const char *password,
  74                         const char *domain,
  75                         const char *sharename)
  76 {
  77         NTSTATUS status = cli_force_encryption(c,
  78                                         username,
  79                                         password,
  80                                         domain);
  81
  82         if (NT_STATUS_EQUAL(status,NT_STATUS_NOT_SUPPORTED)) {
  83                 d_printf("Encryption required and "
  84                         "server that doesn't support "
  85                         "UNIX extensions - failing connect\n");
  86         } else if (NT_STATUS_EQUAL(status,NT_STATUS_UNKNOWN_REVISION)) {
  87                 d_printf("Encryption required and "
  88                         "can't get UNIX CIFS extensions "
  89                         "version from server.\n");
  90         } else if (NT_STATUS_EQUAL(status,NT_STATUS_UNSUPPORTED_COMPRESSION)) {
  91                 d_printf("Encryption required and "
  92                         "share %s doesn't support "
  93                         "encryption.\n", sharename);
  94         } else if (!NT_STATUS_IS_OK(status)) {
  95                 d_printf("Encryption required and "
  96                         "setup failed with error %s.\n",
  97                         nt_errstr(status));
  98         }
  99
 100         return status;
 101 }
 102
 103 /********************************************************************
 104  Return a connection to a server.
 105 ********************************************************************/
 106
 107 static struct cli_state *do_connect(TALLOC_CTX *ctx,
 108                                         const char *server,
 109                                         const char *share,
 110                                         bool show_sessetup,
 111                                         bool force_encrypt,
 112                                         int max_protocol)
 113 {
 114         struct cli_state *c = NULL;
 115         struct nmb_name called, calling;
 116         const char *server_n;
 117         struct sockaddr_storage ss;
 118         char *servicename;
 119         char *sharename;
 120         char *newserver, *newshare;
 121         const char *username;
 122         const char *password;
 123         NTSTATUS status;
 124
 125         /* make a copy so we don't modify the global string 'service' */
 126         servicename = talloc_strdup(ctx,share);
 127         if (!servicename) {
 128                 return NULL;
 129         }
 130         sharename = servicename;
 131         if (*sharename == '\\') {
 132                 sharename += 2;
 133                 if (server == NULL) {
 134                         server = sharename;
 135                 }
 136                 sharename = strchr_m(sharename,'\\');
 137                 if (!sharename) {
 138                         return NULL;
 139                 }
 140                 *sharename = 0;
 141                 sharename++;
 142         }
 143
 144         server_n = server;
 145
 146         zero_sockaddr(&ss);
 147
 148         make_nmb_name(&calling, global_myname(), 0x0);
 149         make_nmb_name(&called , server, name_type);
 150
 151  again:
 152         zero_sockaddr(&ss);
 153
 154         /* have to open a new connection */
 155         if (!(c=cli_initialise()) || (cli_set_port(c, port) != port)) {
 156                 d_printf("Connection to %s failed\n", server_n);
 157                 if (c) {
 158                         cli_shutdown(c);
 159                 }
 160                 return NULL;
 161         }
 162         status = cli_connect(c, server_n, &ss);
 163         if (!NT_STATUS_IS_OK(status)) {
 164                 d_printf("Connection to %s failed (Error %s)\n",
 165                                 server_n,
 166                                 nt_errstr(status));
 167                 cli_shutdown(c);
 168                 return NULL;
 169         }
 170
 171         c->protocol = max_protocol;
 172         c->use_kerberos = cm_creds.use_kerberos;
 173         c->fallback_after_kerberos = cm_creds.fallback_after_kerberos;
 174         cli_setup_signing_state(c, cm_creds.signing_state);
 175
 176         if (!cli_session_request(c, &calling, &called)) {
 177                 char *p;
 178                 d_printf("session request to %s failed (%s)\n",
 179                          called.name, cli_errstr(c));
 180                 cli_shutdown(c);
 181                 c = NULL;
 182                 if ((p=strchr_m(called.name, '.'))) {
 183                         *p = 0;
 184                         goto again;
 185                 }
 186                 if (strcmp(called.name, "*SMBSERVER")) {
 187                         make_nmb_name(&called , "*SMBSERVER", 0x20);
 188                         goto again;
 189                 }
 190                 return NULL;
 191         }
 192
 193         DEBUG(4,(" session request ok\n"));
 194
 195         status = cli_negprot(c);
 196
 197         if (!NT_STATUS_IS_OK(status)) {
 198                 d_printf("protocol negotiation failed: %s\n",
 199                          nt_errstr(status));
 200                 cli_shutdown(c);
 201                 return NULL;
 202         }
 203
 204         if (!cm_creds.got_pass && !cm_creds.use_kerberos) {
 205                 char *label = NULL;
 206                 char *pass;
 207                 label = talloc_asprintf(ctx, "Enter %s's password: ",
 208                         cm_creds.username);
 209                 pass = getpass(label);
 210                 if (pass) {
 211                         cm_set_password(pass);
 212                 }
 213                 TALLOC_FREE(label);
 214         }
 215
 216         username = cm_creds.username ? cm_creds.username : "";
 217         password = cm_creds.password ? cm_creds.password : "";
 218
 219         if (!NT_STATUS_IS_OK(cli_session_setup(c, username,
 220                                                password, strlen(password),
 221                                                password, strlen(password),
 222                                                lp_workgroup()))) {
 223                 /* If a password was not supplied then
 224                  * try again with a null username. */
 225                 if (password[0] || !username[0] || cm_creds.use_kerberos ||
 226                     !NT_STATUS_IS_OK(cli_session_setup(c, "",
 227                                                 "", 0,
 228                                                 "", 0,
 229                                                lp_workgroup()))) {
 230                         d_printf("session setup failed: %s\n", cli_errstr(c));
 231                         if (NT_STATUS_V(cli_nt_error(c)) ==
 232                             NT_STATUS_V(NT_STATUS_MORE_PROCESSING_REQUIRED))
 233                                 d_printf("did you forget to run kinit?\n");
 234                         cli_shutdown(c);
 235                         return NULL;
 236                 }
 237                 d_printf("Anonymous login successful\n");
 238         }
 239
 240         if ( show_sessetup ) {
 241                 if (*c->server_domain) {
 242                         DEBUG(0,("Domain=[%s] OS=[%s] Server=[%s]\n",
 243                                 c->server_domain,c->server_os,c->server_type));
 244                 } else if (*c->server_os || *c->server_type) {
 245                         DEBUG(0,("OS=[%s] Server=[%s]\n",
 246                                  c->server_os,c->server_type));
 247                 }
 248         }
 249         DEBUG(4,(" session setup ok\n"));
 250
 251         /* here's the fun part....to support 'msdfs proxy' shares
 252            (on Samba or windows) we have to issues a TRANS_GET_DFS_REFERRAL
 253            here before trying to connect to the original share.
 254            check_dfs_proxy() will fail if it is a normal share. */
 255
 256         if ((c->capabilities & CAP_DFS) &&
 257                         cli_check_msdfs_proxy(ctx, c, sharename,
 258                                 &newserver, &newshare,
 259                                 force_encrypt,
 260                                 username,
 261                                 password,
 262                                 lp_workgroup())) {
 263                 cli_shutdown(c);
 264                 return do_connect(ctx, newserver,
 265                                 newshare, false,
 266                                 force_encrypt, max_protocol);
 267         }
 268
 269         /* must be a normal share */
 270
 271         if (!cli_send_tconX(c, sharename, "?????",
 272                                 password, strlen(password)+1)) {
 273                 d_printf("tree connect failed: %s\n", cli_errstr(c));
 274                 cli_shutdown(c);
 275                 return NULL;
 276         }
 277
 278         if (force_encrypt) {
 279                 status = cli_cm_force_encryption(c,
 280                                         username,
 281                                         password,
 282                                         lp_workgroup(),
 283                                         sharename);
 284                 if (!NT_STATUS_IS_OK(status)) {
 285                         cli_shutdown(c);
 286                         return NULL;
 287                 }
 288         }
 289
 290         DEBUG(4,(" tconx ok\n"));
 291         return c;
 292 }
 293
 294 /****************************************************************************
 295 ****************************************************************************/
 296
 297 static void cli_cm_set_mntpoint(struct cli_state *c, const char *mnt)
 298 {
 299         struct client_connection *p;
 300         int i;
 301
 302         for (p=connections,i=0; p; p=p->next,i++) {
 303                 if (strequal(p->cli->desthost, c->desthost) &&
 304                                 strequal(p->cli->share, c->share)) {
 305                         break;
 306                 }
 307         }
 308
 309         if (p) {
 310                 char *name = clean_name(NULL, mnt);
 311                 if (!name) {
 312                         return;
 313                 }
 314                 TALLOC_FREE(p->mount);
 315                 p->mount = talloc_strdup(p, name);
 316                 TALLOC_FREE(name);
 317         }
 318 }
 319
 320 /****************************************************************************
 321 ****************************************************************************/
 322
 323 const char *cli_cm_get_mntpoint(struct cli_state *c)
 324 {
 325         struct client_connection *p;
 326         int i;
 327
 328         for (p=connections,i=0; p; p=p->next,i++) {
 329                 if (strequal(p->cli->desthost, c->desthost) &&
 330                                 strequal(p->cli->share, c->share)) {
 331                         break;
 332                 }
 333         }
 334
 335         if (p) {
 336                 return p->mount;
 337         }
 338         return NULL;
 339 }
 340
 341 /********************************************************************
 342  Add a new connection to the list
 343 ********************************************************************/
 344
 345 static struct cli_state *cli_cm_connect(TALLOC_CTX *ctx,
 346                                         struct cli_state *referring_cli,
 347                                         const char *server,
 348                                         const char *share,
 349                                         bool show_hdr,
 350                                         bool force_encrypt,
 351                                         int max_protocol)
 352 {
 353         struct client_connection *node;
 354
 355         /* NB This must be the null context here... JRA. */
 356         node = TALLOC_ZERO_ARRAY(NULL, struct client_connection, 1);
 357         if (!node) {
 358                 return NULL;
 359         }
 360
 361         node->cli = do_connect(ctx, server, share,
 362                                 show_hdr, force_encrypt, max_protocol);
 363
 364         if ( !node->cli ) {
 365                 TALLOC_FREE( node );
 366                 return NULL;
 367         }
 368
 369         DLIST_ADD( connections, node );
 370
 371         cli_cm_set_mntpoint(node->cli, "");
 372
 373         if (referring_cli && referring_cli->posix_capabilities) {
 374                 uint16 major, minor;
 375                 uint32 caplow, caphigh;
 376                 if (cli_unix_extensions_version(node->cli, &major,
 377                                         &minor, &caplow, &caphigh)) {
 378                         cli_set_unix_extensions_capabilities(node->cli,
 379                                         major, minor,
 380                                         caplow, caphigh);
 381                 }
 382         }
 383
 384         return node->cli;
 385 }
 386
 387 /********************************************************************
 388  Return a connection to a server.
 389 ********************************************************************/
 390
 391 static struct cli_state *cli_cm_find(const char *server, const char *share)
 392 {
 393         struct client_connection *p;
 394
 395         for (p=connections; p; p=p->next) {
 396                 if ( strequal(server, p->cli->desthost) &&
 397                                 strequal(share,p->cli->share)) {
 398                         return p->cli;
 399                 }
 400         }
 401
 402         return NULL;
 403 }
 404
 405 /****************************************************************************
 406  Open a client connection to a \\server\share.  Set's the current *cli
 407  global variable as a side-effect (but only if the connection is successful).
 408 ****************************************************************************/
 409
 410 struct cli_state *cli_cm_open(TALLOC_CTX *ctx,
 411                                 struct cli_state *referring_cli,
 412                                 const char *server,
 413                                 const char *share,
 414                                 bool show_hdr,
 415                                 bool force_encrypt,
 416                                 int max_protocol)
 417 {
 418         struct cli_state *c;
 419
 420         /* try to reuse an existing connection */
 421
 422         c = cli_cm_find(server, share);
 423         if (!c) {
 424                 c = cli_cm_connect(ctx, referring_cli,
 425                                 server, share, show_hdr, force_encrypt,
 426                                 max_protocol);
 427         }
 428
 429         return c;
 430 }
 431
 432 /****************************************************************************
 433 ****************************************************************************/
 434
 435 void cli_cm_shutdown(void)
 436 {
 437         struct client_connection *p, *x;
 438
 439         for (p=connections; p;) {
 440                 cli_shutdown(p->cli);
 441                 x = p;
 442                 p = p->next;
 443
 444                 TALLOC_FREE(x);
 445         }
 446
 447         connections = NULL;
 448         return;
 449 }
 450
 451 /****************************************************************************
 452 ****************************************************************************/
 453
 454 void cli_cm_display(void)
 455 {
 456         struct client_connection *p;
 457         int i;
 458
 459         for ( p=connections,i=0; p; p=p->next,i++ ) {
 460                 d_printf("%d:\tserver=%s, share=%s\n",
 461                         i, p->cli->desthost, p->cli->share );
 462         }
 463 }
 464
 465 /****************************************************************************
 466 ****************************************************************************/
 467
 468 static void cm_set_password(const char *newpass)
 469 {
 470         SAFE_FREE(cm_creds.password);
 471         cm_creds.password = SMB_STRDUP(newpass);
 472         if (cm_creds.password) {
 473                 cm_creds.got_pass = true;
 474         }
 475 }
 476
 477 /****************************************************************************
 478 ****************************************************************************/
 479
 480 void cli_cm_set_credentials(struct user_auth_info *auth_info)
 481 {
 482         SAFE_FREE(cm_creds.username);
 483         cm_creds.username = SMB_STRDUP(get_cmdline_auth_info_username(
 484                                                auth_info));
 485
 486         if (get_cmdline_auth_info_got_pass(auth_info)) {
 487                 cm_set_password(get_cmdline_auth_info_password(auth_info));
 488         }
 489
 490         cm_creds.use_kerberos = get_cmdline_auth_info_use_kerberos(auth_info);
 491         cm_creds.fallback_after_kerberos = false;
 492         cm_creds.signing_state = get_cmdline_auth_info_signing_state(auth_info);
 493 }
 494
 495 /****************************************************************************
 496 ****************************************************************************/
 497
 498 void cli_cm_set_port(int port_number)
 499 {
 500         port = port_number;
 501 }
 502
 503 /****************************************************************************
 504 ****************************************************************************/
 505
 506 void cli_cm_set_dest_name_type(int type)
 507 {
 508         name_type = type;
 509 }
 510
 511 /****************************************************************************
 512 ****************************************************************************/
 513
 514 void cli_cm_set_signing_state(int state)
 515 {
 516         cm_creds.signing_state = state;
 517 }
 518
 519 /****************************************************************************
 520 ****************************************************************************/
 521
 522 void cli_cm_set_username(const char *username)
 523 {
 524         SAFE_FREE(cm_creds.username);
 525         cm_creds.username = SMB_STRDUP(username);
 526 }
 527
 528 /****************************************************************************
 529 ****************************************************************************/
 530
 531 void cli_cm_set_password(const char *newpass)
 532 {
 533         SAFE_FREE(cm_creds.password);
 534         cm_creds.password = SMB_STRDUP(newpass);
 535         if (cm_creds.password) {
 536                 cm_creds.got_pass = true;
 537         }
 538 }
 539
 540 /****************************************************************************
 541 ****************************************************************************/
 542
 543 void cli_cm_set_use_kerberos(void)
 544 {
 545         cm_creds.use_kerberos = true;
 546 }
 547
 548 /****************************************************************************
 549 ****************************************************************************/
 550
 551 void cli_cm_set_fallback_after_kerberos(void)
 552 {
 553         cm_creds.fallback_after_kerberos = true;
 554 }
 555
 556 /**********************************************************************
 557  split a dfs path into the server, share name, and extrapath components
 558 **********************************************************************/
 559
 560 static void split_dfs_path(TALLOC_CTX *ctx,
 561                                 const char *nodepath,
 562                                 char **pp_server,
 563                                 char **pp_share,
 564                                 char **pp_extrapath)
 565 {
 566         char *p, *q;
 567         char *path;
 568
 569         *pp_server = NULL;
 570         *pp_share = NULL;
 571         *pp_extrapath = NULL;
 572
 573         path = talloc_strdup(ctx, nodepath);
 574         if (!path) {
 575                 return;
 576         }
 577
 578         if ( path[0] != '\\' ) {
 579                 return;
 580         }
 581
 582         p = strchr_m( path + 1, '\\' );
 583         if ( !p ) {
 584                 return;
 585         }
 586
 587         *p = '\0';
 588         p++;
 589
 590         /* Look for any extra/deep path */
 591         q = strchr_m(p, '\\');
 592         if (q != NULL) {
 593                 *q = '\0';
 594                 q++;
 595                 *pp_extrapath = talloc_strdup(ctx, q);
 596         } else {
 597                 *pp_extrapath = talloc_strdup(ctx, "");
 598         }
 599
 600         *pp_share = talloc_strdup(ctx, p);
 601         *pp_server = talloc_strdup(ctx, &path[1]);
 602 }
 603
 604 /****************************************************************************
 605  Return the original path truncated at the directory component before
 606  the first wildcard character. Trust the caller to provide a NULL
 607  terminated string
 608 ****************************************************************************/
 609
 610 static char *clean_path(TALLOC_CTX *ctx, const char *path)
 611 {
 612         size_t len;
 613         char *p1, *p2, *p;
 614         char *path_out;
 615
 616         /* No absolute paths. */
 617         while (IS_DIRECTORY_SEP(*path)) {
 618                 path++;
 619         }
 620
 621         path_out = talloc_strdup(ctx, path);
 622         if (!path_out) {
 623                 return NULL;
 624         }
 625
 626         p1 = strchr_m(path_out, '*');
 627         p2 = strchr_m(path_out, '?');
 628
 629         if (p1 || p2) {
 630                 if (p1 && p2) {
 631                         p = MIN(p1,p2);
 632                 } else if (!p1) {
 633                         p = p2;
 634                 } else {
 635                         p = p1;
 636                 }
 637                 *p = '\0';
 638
 639                 /* Now go back to the start of this component. */
 640                 p1 = strrchr_m(path_out, '/');
 641                 p2 = strrchr_m(path_out, '\\');
 642                 p = MAX(p1,p2);
 643                 if (p) {
 644                         *p = '\0';
 645                 }
 646         }
 647
 648         /* Strip any trailing separator */
 649
 650         len = strlen(path_out);
 651         if ( (len > 0) && IS_DIRECTORY_SEP(path_out[len-1])) {
 652                 path_out[len-1] = '\0';
 653         }
 654
 655         return path_out;
 656 }
 657
 658 /****************************************************************************
 659 ****************************************************************************/
 660
 661 static char *cli_dfs_make_full_path(TALLOC_CTX *ctx,
 662                                         struct cli_state *cli,
 663                                         const char *dir)
 664 {
 665         /* Ensure the extrapath doesn't start with a separator. */
 666         while (IS_DIRECTORY_SEP(*dir)) {
 667                 dir++;
 668         }
 669
 670         return talloc_asprintf(ctx, "\\%s\\%s\\%s",
 671                         cli->desthost, cli->share, dir);
 672 }
 673
 674 /********************************************************************
 675  check for dfs referral
 676 ********************************************************************/
 677
 678 static bool cli_dfs_check_error( struct cli_state *cli, NTSTATUS status )
 679 {
 680         uint32 flgs2 = SVAL(cli->inbuf,smb_flg2);
 681
 682         /* only deal with DS when we negotiated NT_STATUS codes and UNICODE */
 683
 684         if (!((flgs2&FLAGS2_32_BIT_ERROR_CODES) &&
 685                                 (flgs2&FLAGS2_UNICODE_STRINGS)))
 686                 return false;
 687
 688         if (NT_STATUS_EQUAL(status, NT_STATUS(IVAL(cli->inbuf,smb_rcls))))
 689                 return true;
 690
 691         return false;
 692 }
 693
 694 /********************************************************************
 695  Get the dfs referral link.
 696 ********************************************************************/
 697
 698 bool cli_dfs_get_referral(TALLOC_CTX *ctx,
 699                         struct cli_state *cli,
 700                         const char *path,
 701                         CLIENT_DFS_REFERRAL**refs,
 702                         size_t *num_refs,
 703                         uint16 *consumed)
 704 {
 705         unsigned int data_len = 0;
 706         unsigned int param_len = 0;
 707         uint16 setup = TRANSACT2_GET_DFS_REFERRAL;
 708         char *param;
 709         char *rparam=NULL, *rdata=NULL;
 710         char *p;
 711         char *endp;
 712         size_t pathlen = 2*(strlen(path)+1);
 713         uint16 num_referrals;
 714         CLIENT_DFS_REFERRAL *referrals = NULL;
 715         bool ret = false;
 716
 717         *num_refs = 0;
 718         *refs = NULL;
 719
 720         param = SMB_MALLOC_ARRAY(char, 2+pathlen+2);
 721         if (!param) {
 722                 return false;
 723         }
 724         SSVAL(param, 0, 0x03);  /* max referral level */
 725         p = &param[2];
 726
 727         p += clistr_push(cli, p, path, pathlen, STR_TERMINATE);
 728         param_len = PTR_DIFF(p, param);
 729
 730         if (!cli_send_trans(cli, SMBtrans2,
 731                         NULL,                        /* name */
 732                         -1, 0,                          /* fid, flags */
 733                         &setup, 1, 0,                   /* setup, length, max */
 734                         param, param_len, 2,            /* param, length, max */
 735                         NULL, 0, cli->max_xmit /* data, length, max */
 736                         )) {
 737                 SAFE_FREE(param);
 738                 return false;
 739         }
 740
 741         SAFE_FREE(param);
 742
 743         if (!cli_receive_trans(cli, SMBtrans2,
 744                 &rparam, &param_len,
 745                 &rdata, &data_len)) {
 746                         return false;
 747         }
 748
 749         if (data_len < 4) {
 750                 goto out;
 751         }
 752
 753         endp = rdata + data_len;
 754
 755         *consumed     = SVAL(rdata, 0);
 756         num_referrals = SVAL(rdata, 2);
 757
 758         if (num_referrals != 0) {
 759                 uint16 ref_version;
 760                 uint16 ref_size;
 761                 int i;
 762                 uint16 node_offset;
 763
 764                 referrals = TALLOC_ARRAY(ctx, CLIENT_DFS_REFERRAL,
 765                                 num_referrals);
 766
 767                 if (!referrals) {
 768                         goto out;
 769                 }
 770                 /* start at the referrals array */
 771
 772                 p = rdata+8;
 773                 for (i=0; i<num_referrals && p < endp; i++) {
 774                         if (p + 18 > endp) {
 775                                 goto out;
 776                         }
 777                         ref_version = SVAL(p, 0);
 778                         ref_size    = SVAL(p, 2);
 779                         node_offset = SVAL(p, 16);
 780
 781                         if (ref_version != 3) {
 782                                 p += ref_size;
 783                                 continue;
 784                         }
 785
 786                         referrals[i].proximity = SVAL(p, 8);
 787                         referrals[i].ttl       = SVAL(p, 10);
 788
 789                         if (p + node_offset > endp) {
 790                                 goto out;
 791                         }
 792                         clistr_pull_talloc(ctx, cli, &referrals[i].dfspath,
 793                                 p+node_offset, -1,
 794                                 STR_TERMINATE|STR_UNICODE );
 795
 796                         if (!referrals[i].dfspath) {
 797                                 goto out;
 798                         }
 799                         p += ref_size;
 800                 }
 801                 if (i < num_referrals) {
 802                         goto out;
 803                 }
 804         }
 805
 806         ret = true;
 807
 808         *num_refs = num_referrals;
 809         *refs = referrals;
 810
 811   out:
 812
 813         SAFE_FREE(rdata);
 814         SAFE_FREE(rparam);
 815         return ret;
 816 }
 817
 818 /********************************************************************
 819 ********************************************************************/
 820
 821 bool cli_resolve_path(TALLOC_CTX *ctx,
 822                         const char *mountpt,
 823                         struct cli_state *rootcli,
 824                         const char *path,
 825                         struct cli_state **targetcli,
 826                         char **pp_targetpath)
 827 {
 828         CLIENT_DFS_REFERRAL *refs = NULL;
 829         size_t num_refs = 0;
 830         uint16 consumed;
 831         struct cli_state *cli_ipc = NULL;
 832         char *dfs_path = NULL;
 833         char *cleanpath = NULL;
 834         char *extrapath = NULL;
 835         int pathlen;
 836         char *server = NULL;
 837         char *share = NULL;
 838         struct cli_state *newcli = NULL;
 839         char *newpath = NULL;
 840         char *newmount = NULL;
 841         char *ppath = NULL;
 842         SMB_STRUCT_STAT sbuf;
 843         uint32 attributes;
 844
 845         if ( !rootcli || !path || !targetcli ) {
 846                 return false;
 847         }
 848
 849         /* Don't do anything if this is not a DFS root. */
 850
 851         if ( !rootcli->dfsroot) {
 852                 *targetcli = rootcli;
 853                 *pp_targetpath = talloc_strdup(ctx, path);
 854                 if (!*pp_targetpath) {
 855                         return false;
 856                 }
 857                 return true;
 858         }
 859
 860         *targetcli = NULL;
 861
 862         /* Send a trans2_query_path_info to check for a referral. */
 863
 864         cleanpath = clean_path(ctx, path);
 865         if (!cleanpath) {
 866                 return false;
 867         }
 868
 869         dfs_path = cli_dfs_make_full_path(ctx, rootcli, cleanpath);
 870         if (!dfs_path) {
 871                 return false;
 872         }
 873
 874         if (cli_qpathinfo_basic( rootcli, dfs_path, &sbuf, &attributes)) {
 875                 /* This is an ordinary path, just return it. */
 876                 *targetcli = rootcli;
 877                 *pp_targetpath = talloc_strdup(ctx, path);
 878                 if (!*pp_targetpath) {
 879                         return false;
 880                 }
 881                 goto done;
 882         }
 883
 884         /* Special case where client asked for a path that does not exist */
 885
 886         if (cli_dfs_check_error(rootcli, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
 887                 *targetcli = rootcli;
 888                 *pp_targetpath = talloc_strdup(ctx, path);
 889                 if (!*pp_targetpath) {
 890                         return false;
 891                 }
 892                 goto done;
 893         }
 894
 895         /* We got an error, check for DFS referral. */
 896
 897         if (!cli_dfs_check_error(rootcli, NT_STATUS_PATH_NOT_COVERED)) {
 898                 return false;
 899         }
 900
 901         /* Check for the referral. */
 902
 903         if (!(cli_ipc = cli_cm_open(ctx, rootcli,
 904                                         rootcli->desthost,
 905                                         "IPC$", false,
 906                                         (rootcli->trans_enc_state != NULL),
 907                                         rootcli->protocol))) {
 908                 return false;
 909         }
 910
 911         if (!cli_dfs_get_referral(ctx, cli_ipc, dfs_path, &refs,
 912                         &num_refs, &consumed) || !num_refs) {
 913                 return false;
 914         }
 915
 916         /* Just store the first referral for now. */
 917
 918         if (!refs[0].dfspath) {
 919                 return false;
 920         }
 921         split_dfs_path(ctx, refs[0].dfspath, &server, &share, &extrapath );
 922
 923         if (!server || !share) {
 924                 return false;
 925         }
 926
 927         /* Make sure to recreate the original string including any wildcards. */
 928
 929         dfs_path = cli_dfs_make_full_path(ctx, rootcli, path);
 930         if (!dfs_path) {
 931                 return false;
 932         }
 933         pathlen = strlen(dfs_path)*2;
 934         consumed = MIN(pathlen, consumed);
 935         *pp_targetpath = talloc_strdup(ctx, &dfs_path[consumed/2]);
 936         if (!*pp_targetpath) {
 937                 return false;
 938         }
 939         dfs_path[consumed/2] = '\0';
 940
 941         /*
 942          * *pp_targetpath is now the unconsumed part of the path.
 943          * dfs_path is now the consumed part of the path
 944          * (in \server\share\path format).
 945          */
 946
 947         /* Open the connection to the target server & share */
 948         if ((*targetcli = cli_cm_open(ctx, rootcli,
 949                                         server,
 950                                         share,
 951                                         false,
 952                                         (rootcli->trans_enc_state != NULL),
 953                                         rootcli->protocol)) == NULL) {
 954                 d_printf("Unable to follow dfs referral [\\%s\\%s]\n",
 955                         server, share );
 956                 return false;
 957         }
 958
 959         if (extrapath && strlen(extrapath) > 0) {
 960                 *pp_targetpath = talloc_asprintf(ctx,
 961                                                 "%s%s",
 962                                                 extrapath,
 963                                                 *pp_targetpath);
 964                 if (!*pp_targetpath) {
 965                         return false;
 966                 }
 967         }
 968
 969         /* parse out the consumed mount path */
 970         /* trim off the \server\share\ */
 971
 972         ppath = dfs_path;
 973
 974         if (*ppath != '\\') {
 975                 d_printf("cli_resolve_path: "
 976                         "dfs_path (%s) not in correct format.\n",
 977                         dfs_path );
 978                 return false;
 979         }
 980
 981         ppath++; /* Now pointing at start of server name. */
 982
 983         if ((ppath = strchr_m( dfs_path, '\\' )) == NULL) {
 984                 return false;
 985         }
 986
 987         ppath++; /* Now pointing at start of share name. */
 988
 989         if ((ppath = strchr_m( ppath+1, '\\' )) == NULL) {
 990                 return false;
 991         }
 992
 993         ppath++; /* Now pointing at path component. */
 994
 995         newmount = talloc_asprintf(ctx, "%s\\%s", mountpt, ppath );
 996         if (!newmount) {
 997                 return false;
 998         }
 999
1000         cli_cm_set_mntpoint(*targetcli, newmount);
1001
1002         /* Check for another dfs referral, note that we are not
1003            checking for loops here. */
1004
1005         if (!strequal(*pp_targetpath, "\\") && !strequal(*pp_targetpath, "/")) {
1006                 if (cli_resolve_path(ctx,
1007                                         newmount,
1008                                         *targetcli,
1009                                         *pp_targetpath,
1010                                         &newcli,
1011                                         &newpath)) {
1012                         /*
1013                          * When cli_resolve_path returns true here it's always
1014                          * returning the complete path in newpath, so we're done
1015                          * here.
1016                          */
1017                         *targetcli = newcli;
1018                         *pp_targetpath = newpath;
1019                         return true;
1020                 }
1021         }
1022
1023   done:
1024
1025         /* If returning true ensure we return a dfs root full path. */
1026         if ((*targetcli)->dfsroot) {
1027                 dfs_path = talloc_strdup(ctx, *pp_targetpath);
1028                 if (!dfs_path) {
1029                         return false;
1030                 }
1031                 *pp_targetpath = cli_dfs_make_full_path(ctx, *targetcli, dfs_path);
1032         }
1033
1034         return true;
1035 }
1036
1037 /********************************************************************
1038 ********************************************************************/
1039
1040 static bool cli_check_msdfs_proxy(TALLOC_CTX *ctx,
1041                                 struct cli_state *cli,
1042                                 const char *sharename,
1043                                 char **pp_newserver,
1044                                 char **pp_newshare,
1045                                 bool force_encrypt,
1046                                 const char *username,
1047                                 const char *password,
1048                                 const char *domain)
1049 {
1050         CLIENT_DFS_REFERRAL *refs = NULL;
1051         size_t num_refs = 0;
1052         uint16 consumed;
1053         char *fullpath = NULL;
1054         bool res;
1055         uint16 cnum;
1056         char *newextrapath = NULL;
1057
1058         if (!cli || !sharename) {
1059                 return false;
1060         }
1061
1062         cnum = cli->cnum;
1063
1064         /* special case.  never check for a referral on the IPC$ share */
1065
1066         if (strequal(sharename, "IPC$")) {
1067                 return false;
1068         }
1069
1070         /* send a trans2_query_path_info to check for a referral */
1071
1072         fullpath = talloc_asprintf(ctx, "\\%s\\%s", cli->desthost, sharename );
1073         if (!fullpath) {
1074                 return false;
1075         }
1076
1077         /* check for the referral */
1078
1079         if (!cli_send_tconX(cli, "IPC$", "IPC", NULL, 0)) {
1080                 return false;
1081         }
1082
1083         if (force_encrypt) {
1084                 NTSTATUS status = cli_cm_force_encryption(cli,
1085                                         username,
1086                                         password,
1087                                         lp_workgroup(),
1088                                         "IPC$");
1089                 if (!NT_STATUS_IS_OK(status)) {
1090                         return false;
1091                 }
1092         }
1093
1094         res = cli_dfs_get_referral(ctx, cli, fullpath, &refs, &num_refs, &consumed);
1095
1096         if (!cli_tdis(cli)) {
1097                 return false;
1098         }
1099
1100         cli->cnum = cnum;
1101
1102         if (!res || !num_refs) {
1103                 return false;
1104         }
1105
1106         if (!refs[0].dfspath) {
1107                 return false;
1108         }
1109
1110         split_dfs_path(ctx, refs[0].dfspath, pp_newserver,
1111                         pp_newshare, &newextrapath );
1112
1113         if ((*pp_newserver == NULL) || (*pp_newshare == NULL)) {
1114                 return false;
1115         }
1116
1117         /* check that this is not a self-referral */
1118
1119         if (strequal(cli->desthost, *pp_newserver) &&
1120                         strequal(sharename, *pp_newshare)) {
1121                 return false;
1122         }
1123
1124         return true;
1125 }