Changeset 745 for trunk/server/source4/smb_server/smb

Timestamp:

Nov 27, 2012, 4:43:17 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: updated trunk to 3.6.0

Location:

trunk/server

Files:

• . (modified) (1 prop)
• source4/smb_server/smb/config.mk (deleted)
• source4/smb_server/smb/negprot.c (modified) (15 diffs)
• source4/smb_server/smb/nttrans.c (modified) (6 diffs)
• source4/smb_server/smb/receive.c (modified) (1 diff)
• source4/smb_server/smb/reply.c (modified) (6 diffs)
• source4/smb_server/smb/request.c (modified) (11 diffs)
• source4/smb_server/smb/service.c (modified) (2 diffs)
• source4/smb_server/smb/sesssetup.c (modified) (22 diffs)
• source4/smb_server/smb/signing.c (modified) (2 diffs)
• source4/smb_server/smb/trans2.c (modified) (27 diffs)
• source4/smb_server/smb/wscript_build (copied) (copied from vendor/current/source4/smb_server/smb/wscript_build )

trunk/server/source4/smb_server/smb/negprot.c

@@ -34 +34 @@
 {
         NTSTATUS nt_status;
-        const uint8_t *challenge;
 
         /* muliple negprots are not premitted */
@@ -54 +53 @@
         }
 
-        nt_status = auth_get_challenge(smb_conn->negotiate.auth_context, &challenge);
+        nt_status = auth_get_challenge(smb_conn->negotiate.auth_context, buff);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 DEBUG(0, ("auth_get_challenge() returned %s", nt_errstr(nt_status)));
                 return nt_status;
         }
-
-        memcpy(buff, challenge, 8);
 
         return NT_STATUS_OK;
@@ -92 +89 @@
 static void reply_coreplus(struct smbsrv_request *req, uint16_t choice)
 {
-        uint16_t raw = (lp_readraw(req->smb_conn->lp_ctx)?1:0) | (lp_writeraw(req->smb_conn->lp_ctx)?2:0);
+        uint16_t raw = (lpcfg_readraw(req->smb_conn->lp_ctx)?1:0) | (lpcfg_writeraw(req->smb_conn->lp_ctx)?2:0);
 
         smbsrv_setup_reply(req, 13, 0);
@@ -123 +120 @@
 static void reply_lanman1(struct smbsrv_request *req, uint16_t choice)
 {
-        int raw = (lp_readraw(req->smb_conn->lp_ctx)?1:0) | (lp_writeraw(req->smb_conn->lp_ctx)?2:0);
+        int raw = (lpcfg_readraw(req->smb_conn->lp_ctx)?1:0) | (lpcfg_writeraw(req->smb_conn->lp_ctx)?2:0);
         int secword=0;
         time_t t = req->request_time.tv_sec;
 
-        req->smb_conn->negotiate.encrypted_passwords = lp_encrypted_passwords(req->smb_conn->lp_ctx);
-
-        if (lp_security(req->smb_conn->lp_ctx) != SEC_SHARE)
+        req->smb_conn->negotiate.encrypted_passwords = lpcfg_encrypted_passwords(req->smb_conn->lp_ctx);
+
+        if (lpcfg_security(req->smb_conn->lp_ctx) != SEC_SHARE)
                 secword |= NEGOTIATE_SECURITY_USER_LEVEL;
 
@@ -146 +143 @@
         SSVAL(req->out.vwv, VWV(1), secword); 
         SSVAL(req->out.vwv, VWV(2), req->smb_conn->negotiate.max_recv);
-        SSVAL(req->out.vwv, VWV(3), lp_maxmux(req->smb_conn->lp_ctx));
+        SSVAL(req->out.vwv, VWV(3), lpcfg_maxmux(req->smb_conn->lp_ctx));
         SSVAL(req->out.vwv, VWV(4), 1);
         SSVAL(req->out.vwv, VWV(5), raw); 
@@ -181 +178 @@
 static void reply_lanman2(struct smbsrv_request *req, uint16_t choice)
 {
-        int raw = (lp_readraw(req->smb_conn->lp_ctx)?1:0) | (lp_writeraw(req->smb_conn->lp_ctx)?2:0);
+        int raw = (lpcfg_readraw(req->smb_conn->lp_ctx)?1:0) | (lpcfg_writeraw(req->smb_conn->lp_ctx)?2:0);
         int secword=0;
         time_t t = req->request_time.tv_sec;
 
-        req->smb_conn->negotiate.encrypted_passwords = lp_encrypted_passwords(req->smb_conn->lp_ctx);
+        req->smb_conn->negotiate.encrypted_passwords = lpcfg_encrypted_passwords(req->smb_conn->lp_ctx);
   
-        if (lp_security(req->smb_conn->lp_ctx) != SEC_SHARE)
+        if (lpcfg_security(req->smb_conn->lp_ctx) != SEC_SHARE)
                 secword |= NEGOTIATE_SECURITY_USER_LEVEL;
 
@@ -200 +197 @@
         SSVAL(req->out.vwv, VWV(1), secword); 
         SSVAL(req->out.vwv, VWV(2), req->smb_conn->negotiate.max_recv);
-        SSVAL(req->out.vwv, VWV(3), lp_maxmux(req->smb_conn->lp_ctx));
+        SSVAL(req->out.vwv, VWV(3), lpcfg_maxmux(req->smb_conn->lp_ctx));
         SSVAL(req->out.vwv, VWV(4), 1);
         SSVAL(req->out.vwv, VWV(5), raw); 
@@ -215 +212 @@
         }
 
-        req_push_str(req, NULL, lp_workgroup(req->smb_conn->lp_ctx), -1, STR_TERMINATE);
+        req_push_str(req, NULL, lpcfg_workgroup(req->smb_conn->lp_ctx), -1, STR_TERMINATE);
 
         if (req->smb_conn->signing.mandatory_signing) {
@@ -237 +234 @@
                 SCVAL(req->out.vwv+1, VWV(16), 8);
         }
-        req_push_str(req, NULL, lp_workgroup(req->smb_conn->lp_ctx), -1, STR_UNICODE|STR_TERMINATE|STR_NOALIGN);
-        req_push_str(req, NULL, lp_netbios_name(req->smb_conn->lp_ctx), -1, STR_UNICODE|STR_TERMINATE|STR_NOALIGN);
+        req_push_str(req, NULL, lpcfg_workgroup(req->smb_conn->lp_ctx), -1, STR_UNICODE|STR_TERMINATE|STR_NOALIGN);
+        req_push_str(req, NULL, lpcfg_netbios_name(req->smb_conn->lp_ctx), -1, STR_UNICODE|STR_TERMINATE|STR_NOALIGN);
         DEBUG(3,("not using extended security (SPNEGO or NTLMSSP)\n"));
 }
@@ -261 +258 @@
                 CAP_LEVEL_II_OPLOCKS | CAP_NT_SMBS | CAP_RPC_REMOTE_APIS;
 
-        req->smb_conn->negotiate.encrypted_passwords = lp_encrypted_passwords(req->smb_conn->lp_ctx);
+        req->smb_conn->negotiate.encrypted_passwords = lpcfg_encrypted_passwords(req->smb_conn->lp_ctx);
 
         /* do spnego in user level security if the client
@@ -267 +264 @@
         
         if (req->smb_conn->negotiate.encrypted_passwords && 
-            (lp_security(req->smb_conn->lp_ctx) != SEC_SHARE) &&
-            lp_use_spnego(req->smb_conn->lp_ctx) &&
+            (lpcfg_security(req->smb_conn->lp_ctx) != SEC_SHARE) &&
+            lpcfg_use_spnego(req->smb_conn->lp_ctx) &&
             (req->flags2 & FLAGS2_EXTENDED_SECURITY)) {
                 negotiate_spnego = true; 
@@ -274 +271 @@
         }
         
-        if (lp_unix_extensions(req->smb_conn->lp_ctx)) {
+        if (lpcfg_unix_extensions(req->smb_conn->lp_ctx)) {
                 capabilities |= CAP_UNIX;
         }
         
-        if (lp_large_readwrite(req->smb_conn->lp_ctx)) {
+        if (lpcfg_large_readwrite(req->smb_conn->lp_ctx)) {
                 capabilities |= CAP_LARGE_READX | CAP_LARGE_WRITEX | CAP_W2K_SMBS;
         }
@@ -287 +284 @@
         }
 
-        if (lp_readraw(req->smb_conn->lp_ctx) && 
-            lp_writeraw(req->smb_conn->lp_ctx)) {
+        if (lpcfg_readraw(req->smb_conn->lp_ctx) &&
+            lpcfg_writeraw(req->smb_conn->lp_ctx)) {
                 capabilities |= CAP_RAW_MODE;
         }
         
         /* allow for disabling unicode */
-        if (lp_unicode(req->smb_conn->lp_ctx)) {
+        if (lpcfg_unicode(req->smb_conn->lp_ctx)) {
                 capabilities |= CAP_UNICODE;
         }
 
-        if (lp_nt_status_support(req->smb_conn->lp_ctx)) {
+        if (lpcfg_nt_status_support(req->smb_conn->lp_ctx)) {
                 capabilities |= CAP_STATUS32;
         }
         
-        if (lp_host_msdfs(req->smb_conn->lp_ctx)) {
+        if (lpcfg_host_msdfs(req->smb_conn->lp_ctx)) {
                 capabilities |= CAP_DFS;
         }
         
-        if (lp_security(req->smb_conn->lp_ctx) != SEC_SHARE) {
+        if (lpcfg_security(req->smb_conn->lp_ctx) != SEC_SHARE) {
                 secword |= NEGOTIATE_SECURITY_USER_LEVEL;
         }
@@ -332 +329 @@
            the specification - all the command words after the secword
            are offset by 1 byte */
-        SSVAL(req->out.vwv+1, VWV(1), lp_maxmux(req->smb_conn->lp_ctx));
+        SSVAL(req->out.vwv+1, VWV(1), lpcfg_maxmux(req->smb_conn->lp_ctx));
         SSVAL(req->out.vwv+1, VWV(2), 1); /* num vcs */
         SIVAL(req->out.vwv+1, VWV(3), req->smb_conn->negotiate.max_recv);
@@ -522 +519 @@
                 int i;
 
-                if (supported_protocols[protocol].protocol_level > lp_srv_maxprotocol(req->smb_conn->lp_ctx)) 
+                if (supported_protocols[protocol].protocol_level > lpcfg_srv_maxprotocol(req->smb_conn->lp_ctx))
                         continue;
-                if (supported_protocols[protocol].protocol_level < lp_srv_minprotocol(req->smb_conn->lp_ctx)) 
+                if (supported_protocols[protocol].protocol_level < lpcfg_srv_minprotocol(req->smb_conn->lp_ctx))
                         continue;
 

trunk/server/source4/smb_server/smb/nttrans.c

@@ -120 +120 @@
 
         io->ntcreatex.in.flags            = IVAL(params,  0);
-        io->ntcreatex.in.root_fid         = IVAL(params,  4);
+        io->ntcreatex.in.root_fid.ntvfs   = smbsrv_pull_fnum(req, params, 4);
         io->ntcreatex.in.access_mask      = IVAL(params,  8);
         io->ntcreatex.in.alloc_size       = BVAL(params, 12);
@@ -135 +135 @@
         io->ntcreatex.in.ea_list          = NULL;
         io->ntcreatex.in.query_maximal_access = false;
+        io->ntcreatex.in.private_flags    = 0;
 
         req_pull_string(&req->in.bufinfo, &io->ntcreatex.in.fname, 
@@ -159 +160 @@
                         return NT_STATUS_NO_MEMORY;
                 }
-                ndr_err = ndr_pull_struct_blob(&blob, io, NULL,
+                ndr_err = ndr_pull_struct_blob(&blob, io, 
                                                io->ntcreatex.in.sec_desc,
                                                (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
@@ -206 +207 @@
         params = op->trans->out.params.data;
 
-        ndr_err = ndr_push_struct_blob(&op->trans->out.data, op, NULL,
+        ndr_err = ndr_push_struct_blob(&op->trans->out.data, op, 
                                        io->query_secdesc.out.sd,
                                        (ndr_push_flags_fn_t)ndr_push_security_descriptor);
@@ -272 +273 @@
         NT_STATUS_HAVE_NO_MEMORY(io->set_secdesc.in.sd);
 
-        ndr_err = ndr_pull_struct_blob(&trans->in.data, req, NULL,
+        ndr_err = ndr_pull_struct_blob(&trans->in.data, req, 
                                        io->set_secdesc.in.sd,
                                        (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
@@ -528 +529 @@
         do {
                 uint32_t this_data, this_param, max_bytes;
-                uint_t align1 = 1, align2 = (params_left ? 2 : 0);
+                unsigned int align1 = 1, align2 = (params_left ? 2 : 0);
                 struct smbsrv_request *this_req;
 

trunk/server/source4/smb_server/smb/receive.c

@@ -664 +664 @@
         /* this is the size that w2k uses, and it appears to be important for
            good performance */
-        smb_conn->negotiate.max_recv = lp_max_xmit(lp_ctx);
+        smb_conn->negotiate.max_recv = lpcfg_max_xmit(lp_ctx);
 
         smb_conn->negotiate.zone_offset = get_time_zone(time(NULL));
 
-        smb_conn->config.security = lp_security(lp_ctx);
-        smb_conn->config.nt_status_support = lp_nt_status_support(lp_ctx);
+        smb_conn->config.security = lpcfg_security(lp_ctx);
+        smb_conn->config.nt_status_support = lpcfg_nt_status_support(lp_ctx);
 
         status = smbsrv_init_sessions(smb_conn, UINT16_MAX);

trunk/server/source4/smb_server/smb/reply.c

@@ -812 +812 @@
         union smb_read *io;
 
-        SMBSRV_CHECK_ASYNC_STATUS(io, union smb_read);
+        SMBSRV_CHECK_ASYNC_STATUS_ERR(io, union smb_read);
 
         /* readx reply packets can be over-sized */
@@ -835 +835 @@
         SMBSRV_VWV_RESERVED(8, 4);
 
+        if (!NT_STATUS_IS_OK(req->ntvfs->async_states->status)) {
+                smbsrv_setup_error(req, req->ntvfs->async_states->status);
+        }
+
         smbsrv_chain_reply(req);
 }
@@ -1381 +1385 @@
         union smb_lpq *lpq;
         int i, maxcount;
-        const uint_t el_size = 28;
+        const unsigned int el_size = 28;
 
         SMBSRV_CHECK_ASYNC_STATUS(lpq,union smb_lpq);
@@ -1648 +1652 @@
 {
         union smb_lock *lck;
-        uint_t total_locks, i;
-        uint_t lck_size;
+        unsigned int total_locks, i;
+        unsigned int lck_size;
         uint8_t *p;
 
@@ -2217 +2221 @@
         fname_len =                         SVAL(req->in.vwv, 5);
         io->ntcreatex.in.flags =            IVAL(req->in.vwv, 7);
-        io->ntcreatex.in.root_fid =         IVAL(req->in.vwv, 11);
+        io->ntcreatex.in.root_fid.ntvfs =   smbsrv_pull_fnum(req, req->in.vwv, 11);
         io->ntcreatex.in.access_mask =      IVAL(req->in.vwv, 15);
         io->ntcreatex.in.alloc_size =       BVAL(req->in.vwv, 19);
@@ -2229 +2233 @@
         io->ntcreatex.in.sec_desc         = NULL;
         io->ntcreatex.in.query_maximal_access = false;
-
-        /* we use a couple of bits of the create options internally */
-        if (io->ntcreatex.in.create_options & NTCREATEX_OPTIONS_PRIVATE_MASK) {
-                smbsrv_send_error(req, NT_STATUS_INVALID_PARAMETER);
-                return;
-        }
+        io->ntcreatex.in.private_flags    = 0;
 
         /* we need a neater way to handle this alignment */

trunk/server/source4/smb_server/smb/request.c

@@ -77 +77 @@
   setup a chained reply in req->out with the given word count and initial data buffer size. 
 */
-static void req_setup_chain_reply(struct smbsrv_request *req, uint_t wct, uint_t buflen)
+static void req_setup_chain_reply(struct smbsrv_request *req, unsigned int wct, unsigned int buflen)
 {
         uint32_t chain_base_size = req->out.size;
@@ -111 +111 @@
   send the reply on its way
 */
-void smbsrv_setup_reply(struct smbsrv_request *req, uint_t wct, size_t buflen)
+void smbsrv_setup_reply(struct smbsrv_request *req, unsigned int wct, size_t buflen)
 {
         uint16_t flags2;
@@ -234 +234 @@
   point at the same offset into the packet as before this call
 */
-static void req_grow_allocation(struct smbsrv_request *req, uint_t new_size)
+static void req_grow_allocation(struct smbsrv_request *req, unsigned int new_size)
 {
         int delta;
@@ -400 +400 @@
 {
         size_t len;
-        uint_t grow_size;
+        unsigned int grow_size;
         uint8_t *buf0;
         const int max_bytes_per_char = 3;
@@ -479 +479 @@
   of bytes consumed in the packet is returned
 */
-static size_t req_pull_ucs2(struct request_bufinfo *bufinfo, const char **dest, const uint8_t *src, int byte_len, uint_t flags)
+static size_t req_pull_ucs2(struct request_bufinfo *bufinfo, const char **dest, const uint8_t *src, int byte_len, unsigned int flags)
 {
         int src_len, src_len2, alignment=0;
@@ -537 +537 @@
   of bytes consumed in the packet is returned
 */
-static size_t req_pull_ascii(struct request_bufinfo *bufinfo, const char **dest, const uint8_t *src, int byte_len, uint_t flags)
+static size_t req_pull_ascii(struct request_bufinfo *bufinfo, const char **dest, const uint8_t *src, int byte_len, unsigned int flags)
 {
         int src_len, src_len2;
@@ -586 +586 @@
   of bytes consumed in the packet is returned
 */
-size_t req_pull_string(struct request_bufinfo *bufinfo, const char **dest, const uint8_t *src, int byte_len, uint_t flags)
+size_t req_pull_string(struct request_bufinfo *bufinfo, const char **dest, const uint8_t *src, int byte_len, unsigned int flags)
 {
         if (!(flags & STR_ASCII) && 
@@ -606 +606 @@
   match win2000 behaviour
 */
-size_t req_pull_ascii4(struct request_bufinfo *bufinfo, const char **dest, const uint8_t *src, uint_t flags)
+size_t req_pull_ascii4(struct request_bufinfo *bufinfo, const char **dest, const uint8_t *src, unsigned int flags)
 {
         ssize_t ret;
@@ -668 +668 @@
    pull an open file handle from a packet, taking account of the chained_fnum
 */
-static uint16_t req_fnum(struct smbsrv_request *req, const uint8_t *base, uint_t offset)
+static uint16_t req_fnum(struct smbsrv_request *req, const uint8_t *base, unsigned int offset)
 {
         if (req->chained_fnum != -1) {
@@ -676 +676 @@
 }
 
-struct ntvfs_handle *smbsrv_pull_fnum(struct smbsrv_request *req, const uint8_t *base, uint_t offset)
+struct ntvfs_handle *smbsrv_pull_fnum(struct smbsrv_request *req, const uint8_t *base, unsigned int offset)
 {
         struct smbsrv_handle *handle;
@@ -700 +700 @@
 }
 
-void smbsrv_push_fnum(uint8_t *base, uint_t offset, struct ntvfs_handle *ntvfs)
+void smbsrv_push_fnum(uint8_t *base, unsigned int offset, struct ntvfs_handle *ntvfs)
 {
         struct smbsrv_handle *handle = talloc_get_type(ntvfs->frontend_data.private_data,

trunk/server/source4/smb_server/smb/service.c

@@ -71 +71 @@
         }
 
-        status = ntvfs_set_addr_callbacks(tcon->ntvfs, smbsrv_get_my_addr, smbsrv_get_peer_addr, req->smb_conn);
+        status = ntvfs_set_addresses(tcon->ntvfs,
+                                     req->smb_conn->connection->local_address,
+                                     req->smb_conn->connection->remote_address);
         if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(0,("make_connection: NTVFS failed to set the addr callbacks!\n"));
+                DEBUG(0,("make_connection: NTVFS failed to set the addresses!\n"));
                 goto failed;
         }
@@ -190 +192 @@
         con->tconx.out.tid = req->tcon->tid;
         con->tconx.out.options = SMB_SUPPORT_SEARCH_BITS | (share_int_option(req->tcon->ntvfs->config, SHARE_CSC_POLICY, SHARE_CSC_POLICY_DEFAULT) << 2);
-        if (share_bool_option(req->tcon->ntvfs->config, SHARE_MSDFS_ROOT, SHARE_MSDFS_ROOT_DEFAULT) && lp_host_msdfs(req->smb_conn->lp_ctx)) {
+        if (share_bool_option(req->tcon->ntvfs->config, SHARE_MSDFS_ROOT, SHARE_MSDFS_ROOT_DEFAULT) && lpcfg_host_msdfs(req->smb_conn->lp_ctx)) {
                 con->tconx.out.options |= SMB_SHARE_IN_DFS;
         }

trunk/server/source4/smb_server/smb/sesssetup.c

@@ -24 +24 @@
 
 #include "includes.h"
+#include <tevent.h>
 #include "version.h"
 #include "auth/gensec/gensec.h"
@@ -30 +31 @@
 #include "smbd/service_stream.h"
 #include "param/param.h"
+#include "../lib/tsocket/tsocket.h"
+#include "lib/stream/packet.h"
+
+struct sesssetup_context {
+        struct auth_context *auth_context;
+        struct smbsrv_request *req;
+};
 
 /*
@@ -40 +48 @@
         (*lanman) = talloc_asprintf(req, "Samba %s", SAMBA_VERSION_STRING);
         (*domain) = talloc_asprintf(req, "%s", 
-                                    lp_workgroup(req->smb_conn->lp_ctx));
+                                    lpcfg_workgroup(req->smb_conn->lp_ctx));
 }
 
@@ -55 +63 @@
 }
 
-static void sesssetup_old_send(struct auth_check_password_request *areq,
-                               void *private_data)
-{
-        struct smbsrv_request *req = talloc_get_type(private_data, struct smbsrv_request);
+static void sesssetup_old_send(struct tevent_req *subreq)
+{
+        struct sesssetup_context *state = tevent_req_callback_data(subreq, struct sesssetup_context);
+        struct smbsrv_request *req = state->req;
+
         union smb_sesssetup *sess = talloc_get_type(req->io_ptr, union smb_sesssetup);
-        struct auth_serversupplied_info *server_info = NULL;
+        struct auth_user_info_dc *user_info_dc = NULL;
         struct auth_session_info *session_info;
         struct smbsrv_session *smb_sess;
         NTSTATUS status;
-
-        status = auth_check_password_recv(areq, req, &server_info);
-        if (!NT_STATUS_IS_OK(status)) goto failed;
-
-        /* This references server_info into session_info */
-        status = auth_generate_session_info(req, req->smb_conn->connection->event.ctx, req->smb_conn->lp_ctx, 
-                                            server_info, &session_info);
+        uint32_t flags;
+
+        status = auth_check_password_recv(subreq, req, &user_info_dc);
+        TALLOC_FREE(subreq);
+        if (!NT_STATUS_IS_OK(status)) goto failed;
+
+        flags = AUTH_SESSION_INFO_DEFAULT_GROUPS;
+        if (user_info_dc->info->authenticated) {
+                flags |= AUTH_SESSION_INFO_AUTHENTICATED;
+        }
+        /* This references user_info_dc into session_info */
+        status = req->smb_conn->negotiate.auth_context->generate_session_info(req,
+                                                                              req->smb_conn->negotiate.auth_context,
+                                                                              user_info_dc, flags, &session_info);
         if (!NT_STATUS_IS_OK(status)) goto failed;
 
@@ -91 +107 @@
 
 failed:
-        status = auth_nt_status_squash(status);
+        status = nt_status_squash(status);
         smbsrv_sesssetup_backend_send(req, sess, status);
 }
@@ -101 +117 @@
 {
         struct auth_usersupplied_info *user_info = NULL;
-        struct socket_address *remote_address;
+        struct tsocket_address *remote_address;
         const char *remote_machine = NULL;
+        struct tevent_req *subreq;
+        struct sesssetup_context *state;
 
         sess->old.out.vuid = 0;
@@ -120 +138 @@
         }
         
-        remote_address = socket_get_peer_addr(req->smb_conn->connection->socket, req);
+        remote_address = socket_get_remote_addr(req->smb_conn->connection->socket, req);
         if (!remote_address) goto nomem;
 
         if (!remote_machine) {
-                remote_machine = remote_address->addr;
-        }
-
-        user_info = talloc(req, struct auth_usersupplied_info);
+                remote_machine = tsocket_address_inet_addr_string(remote_address, req);
+                if (!remote_machine) goto nomem;
+        }
+
+        user_info = talloc_zero(req, struct auth_usersupplied_info);
         if (!user_info) goto nomem;
         
@@ -143 +162 @@
         user_info->password.response.nt = data_blob(NULL, 0);
 
-        auth_check_password_send(req->smb_conn->negotiate.auth_context, user_info,
-                                 sesssetup_old_send, req);
+        state = talloc(req, struct sesssetup_context);
+        if (!state) goto nomem;
+
+        if (req->smb_conn->negotiate.auth_context) {
+                state->auth_context = req->smb_conn->negotiate.auth_context;
+        } else {
+                /* TODO: should we use just "anonymous" here? */
+                NTSTATUS status = auth_context_create(state,
+                                                      req->smb_conn->connection->event.ctx,
+                                                      req->smb_conn->connection->msg_ctx,
+                                                      req->smb_conn->lp_ctx,
+                                                      &state->auth_context);
+                if (!NT_STATUS_IS_OK(status)) {
+                        smbsrv_sesssetup_backend_send(req, sess, status);
+                        return;
+                }
+        }
+
+        state->req = req;
+
+        subreq = auth_check_password_send(state,
+                                          req->smb_conn->connection->event.ctx,
+                                          req->smb_conn->negotiate.auth_context,
+                                          user_info);
+        if (!subreq) goto nomem;
+        tevent_req_set_callback(subreq, sesssetup_old_send, state);
         return;
 
@@ -151 +194 @@
 }
 
-static void sesssetup_nt1_send(struct auth_check_password_request *areq,
-                               void *private_data)
-{
-        struct smbsrv_request *req = talloc_get_type(private_data, struct smbsrv_request);
+static void sesssetup_nt1_send(struct tevent_req *subreq)
+{
+        struct sesssetup_context *state = tevent_req_callback_data(subreq, struct sesssetup_context);
+        struct smbsrv_request *req = state->req;
         union smb_sesssetup *sess = talloc_get_type(req->io_ptr, union smb_sesssetup);
-        struct auth_serversupplied_info *server_info = NULL;
+        struct auth_user_info_dc *user_info_dc = NULL;
         struct auth_session_info *session_info;
         struct smbsrv_session *smb_sess;
+
+        uint32_t flags;
         NTSTATUS status;
 
-        status = auth_check_password_recv(areq, req, &server_info);
-        if (!NT_STATUS_IS_OK(status)) goto failed;
-
-        /* This references server_info into session_info */
-        status = auth_generate_session_info(req, req->smb_conn->connection->event.ctx, 
-                                            req->smb_conn->lp_ctx, 
-                                            server_info, &session_info);
+        status = auth_check_password_recv(subreq, req, &user_info_dc);
+        TALLOC_FREE(subreq);
+        if (!NT_STATUS_IS_OK(status)) goto failed;
+
+        flags = AUTH_SESSION_INFO_DEFAULT_GROUPS;
+        if (user_info_dc->info->authenticated) {
+                flags |= AUTH_SESSION_INFO_AUTHENTICATED;
+        }
+        /* This references user_info_dc into session_info */
+        status = state->auth_context->generate_session_info(req,
+                                                            state->auth_context,
+                                                            user_info_dc,
+                                                            flags,
+                                                            &session_info);
         if (!NT_STATUS_IS_OK(status)) goto failed;
 
@@ -195 +247 @@
         status = NT_STATUS_OK;
 failed:
-        status = auth_nt_status_squash(status);
+        status = nt_status_squash(status);
         smbsrv_sesssetup_backend_send(req, sess, status);
 }
@@ -205 +257 @@
 {
         NTSTATUS status;
-        struct auth_context *auth_context;
         struct auth_usersupplied_info *user_info = NULL;
-        struct socket_address *remote_address;
+        struct tsocket_address *remote_address;
         const char *remote_machine = NULL;
-        
+        struct tevent_req *subreq;
+        struct sesssetup_context *state;
+
         sess->nt1.out.vuid = 0;
         sess->nt1.out.action = 0;
@@ -222 +275 @@
                 req->smb_conn->negotiate.client_caps = sess->nt1.in.capabilities;
         }
+
+        state = talloc(req, struct sesssetup_context);
+        if (!state) goto nomem;
+
+        state->req = req;
 
         if (req->smb_conn->negotiate.oid) {
@@ -232 +290 @@
 
                 /* TODO: should we use just "anonymous" here? */
-                status = auth_context_create(req, 
+                status = auth_context_create(state,
                                              req->smb_conn->connection->event.ctx,
                                              req->smb_conn->connection->msg_ctx,
                                              req->smb_conn->lp_ctx,
-                                             &auth_context);
+                                             &state->auth_context);
                 if (!NT_STATUS_IS_OK(status)) goto failed;
+        } else if (req->smb_conn->negotiate.auth_context) {
+                state->auth_context = req->smb_conn->negotiate.auth_context;
         } else {
-                auth_context = req->smb_conn->negotiate.auth_context;
+                /* TODO: should we use just "anonymous" here? */
+                status = auth_context_create(state,
+                                             req->smb_conn->connection->event.ctx,
+                                             req->smb_conn->connection->msg_ctx,
+                                             req->smb_conn->lp_ctx,
+                                             &state->auth_context);
+                if (!NT_STATUS_IS_OK(status)) goto failed;
         }
 
@@ -246 +312 @@
         }
 
-        remote_address = socket_get_peer_addr(req->smb_conn->connection->socket, req);
+        remote_address = socket_get_remote_addr(req->smb_conn->connection->socket, req);
         if (!remote_address) goto nomem;
 
         if (!remote_machine) {
-                remote_machine = remote_address->addr;
-        }
-
-        user_info = talloc(req, struct auth_usersupplied_info);
+                remote_machine = tsocket_address_inet_addr_string(remote_address, req);
+                if (!remote_machine) goto nomem;
+        }
+
+        user_info = talloc_zero(req, struct auth_usersupplied_info);
         if (!user_info) goto nomem;
 
@@ -270 +337 @@
         user_info->password.response.nt.data = talloc_steal(user_info, sess->nt1.in.password2.data);
 
-        auth_check_password_send(auth_context, user_info,
-                                 sesssetup_nt1_send, req);
+        subreq = auth_check_password_send(state,
+                                          req->smb_conn->connection->event.ctx,
+                                          state->auth_context,
+                                          user_info);
+        if (!subreq) goto nomem;
+        tevent_req_set_callback(subreq, sesssetup_nt1_send, state);
+
         return;
 
@@ -277 +349 @@
         status = NT_STATUS_NO_MEMORY;
 failed:
-        status = auth_nt_status_squash(status);
+        status = nt_status_squash(status);
         smbsrv_sesssetup_backend_send(req, sess, status);
 }
@@ -287 +359 @@
 };
 
-static void sesssetup_spnego_send(struct gensec_update_request *greq, void *private_data)
-{
-        struct sesssetup_spnego_state *s = talloc_get_type(private_data,
+static void sesssetup_spnego_send(struct tevent_req *subreq)
+{
+        struct sesssetup_spnego_state *s = tevent_req_callback_data(subreq,
                                            struct sesssetup_spnego_state);
         struct smbsrv_request *req = s->req;
@@ -299 +371 @@
         DATA_BLOB session_key;
 
-        status = gensec_update_recv(greq, req, &sess->spnego.out.secblob);
+        status = gensec_update_recv(subreq, req, &sess->spnego.out.secblob);
+        packet_recv_enable(req->smb_conn->packet);
+        TALLOC_FREE(subreq);
         if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
                 goto done;
@@ -324 +398 @@
         sess->spnego.out.vuid = smb_sess->vuid;
 failed:
-        status = auth_nt_status_squash(status);
+        status = nt_status_squash(status);
         smbsrv_sesssetup_backend_send(req, sess, status);
         if (!NT_STATUS_IS_OK(status) && 
@@ -341 +415 @@
         struct sesssetup_spnego_state *s = NULL;
         uint16_t vuid;
+        struct tevent_req *subreq;
 
         sess->spnego.out.vuid = 0;
@@ -408 +483 @@
         s->smb_sess     = smb_sess;
 
-        gensec_update_send(smb_sess->gensec_ctx, sess->spnego.in.secblob,
-                           sesssetup_spnego_send, s);
+        subreq = gensec_update_send(s,
+                                    req->smb_conn->connection->event.ctx,
+                                    smb_sess->gensec_ctx,
+                                    sess->spnego.in.secblob);
+        if (!subreq) {
+                goto nomem;
+        }
+        /* disable receipt of more packets on this socket until we've
+           finished with the session setup. This avoids a problem with
+           crashes if we get EOF on the socket while processing a session
+           setup */
+        packet_recv_disable(req->smb_conn->packet);
+        tevent_req_set_callback(subreq, sesssetup_spnego_send, s);
+
         return;
 
@@ -416 +503 @@
 failed:
         talloc_free(smb_sess);
-        status = auth_nt_status_squash(status);
+        status = nt_status_squash(status);
         smbsrv_sesssetup_backend_send(req, sess, status);
 }

trunk/server/source4/smb_server/smb/signing.c

@@ -83 +83 @@
         }
         
-        switch (lp_server_signing(smb_conn->lp_ctx)) {
+        switch (lpcfg_server_signing(smb_conn->lp_ctx)) {
         case SMB_SIGNING_OFF:
                 smb_conn->signing.allow_smb_signing = false;
@@ -100 +100 @@
                  * clients */
 
-                if (lp_server_role(smb_conn->lp_ctx) == ROLE_DOMAIN_CONTROLLER) {
+                if (lpcfg_server_role(smb_conn->lp_ctx) == ROLE_DOMAIN_CONTROLLER) {
                         smb_conn->signing.allow_smb_signing = true;
                         smb_conn->signing.mandatory_signing = true;

trunk/server/source4/smb_server/smb/trans2.c

@@ -3 +3 @@
    transaction2 handling
    Copyright (C) Andrew Tridgell 2003
+   Copyright Matthieu Patou 2010 mat@matws.net
 
    This program is free software; you can redistribute it and/or modify
@@ -22 +23 @@
 
 #include "includes.h"
+#include "smbd/service_stream.h"
 #include "smb_server/smb_server.h"
 #include "ntvfs/ntvfs.h"
 #include "libcli/raw/libcliraw.h"
 #include "libcli/raw/raw_proto.h"
+#include "librpc/gen_ndr/dfsblobs.h"
+#include "librpc/gen_ndr/ndr_dfsblobs.h"
+#include "dsdb/samdb/samdb.h"
+#include "auth/session.h"
+#include "param/param.h"
+#include "lib/tsocket/tsocket.h"
+
+#define MAX_DFS_RESPONSE 56*1024 /* 56 Kb */
 
 #define TRANS2_CHECK_ASYNC_STATUS_SIMPLE do { \
@@ -54 +64 @@
         void *op_info;
 };
-
+/* A DC set is a group of DC, they might have been grouped together
+   because they belong to the same site, or to site with same cost ...
+*/
+struct dc_set {
+        const char **names;
+        uint32_t count;
+};
 #define CHECK_MIN_BLOB_SIZE(blob, size) do { \
         if ((blob)->length < (size)) { \
@@ -205 +221 @@
         smbsrv_push_fnum(trans->out.params.data, VWV(0), io->t2open.out.file.ntvfs);
         SSVAL(trans->out.params.data, VWV(1), io->t2open.out.attrib);
-        srv_push_dos_date3(req->smb_conn, trans->out.params.data, 
+        srv_push_dos_date3(req->smb_conn, trans->out.params.data,
                            VWV(2), io->t2open.out.write_time);
         SIVAL(trans->out.params.data, VWV(4), io->t2open.out.size);
@@ -240 +256 @@
         io->t2open.in.search_attrs = SVAL(trans->in.params.data, VWV(2));
         io->t2open.in.file_attrs   = SVAL(trans->in.params.data, VWV(3));
-        io->t2open.in.write_time   = srv_pull_dos_date(req->smb_conn, 
+        io->t2open.in.write_time   = srv_pull_dos_date(req->smb_conn,
                                                     trans->in.params.data + VWV(4));
         io->t2open.in.open_func    = SVAL(trans->in.params.data, VWV(6));
@@ -301 +317 @@
         }
 
-        TRANS2_CHECK(ea_pull_list(&trans->in.data, io, 
-                                  &io->t2mkdir.in.num_eas, 
+        TRANS2_CHECK(ea_pull_list(&trans->in.data, io,
+                                  &io->t2mkdir.in.num_eas,
                                   &io->t2mkdir.in.eas));
 
@@ -363 +379 @@
                 TRANS2_CHECK(smbsrv_blob_grow_data(mem_ctx, blob, list_size));
 
-                ea_put_list(blob->data, 
+                ea_put_list(blob->data,
                             st->ea_list.out.num_eas, st->ea_list.out.eas);
                 return NT_STATUS_OK;
@@ -372 +388 @@
                 TRANS2_CHECK(smbsrv_blob_grow_data(mem_ctx, blob, list_size));
 
-                ea_put_list(blob->data, 
+                ea_put_list(blob->data,
                             st->all_eas.out.num_eas, st->all_eas.out.eas);
                 return NT_STATUS_OK;
@@ -473 +489 @@
 
         if (st->generic.level == RAW_FILEINFO_EA_LIST) {
-                TRANS2_CHECK(ea_pull_name_list(&trans->in.data, req, 
+                TRANS2_CHECK(ea_pull_name_list(&trans->in.data, req,
                                                &st->ea_list.in.num_names,
                                                &st->ea_list.in.ea_names));
@@ -514 +530 @@
 
         if (st->generic.level == RAW_FILEINFO_EA_LIST) {
-                TRANS2_CHECK(ea_pull_name_list(&trans->in.data, req, 
+                TRANS2_CHECK(ea_pull_name_list(&trans->in.data, req,
                                                &st->ea_list.in.num_names,
                                                &st->ea_list.in.ea_names));
@@ -554 +570 @@
 
         case RAW_SFILEINFO_EA_SET:
-                return ea_pull_list(blob, req, 
-                                    &st->ea_set.in.num_eas, 
+                return ea_pull_list(blob, req,
+                                    &st->ea_set.in.num_eas,
                                     &st->ea_set.in.eas);
 
@@ -699 +715 @@
 
 /*
-  fill a single entry in a trans2 find reply 
+  fill a single entry in a trans2 find reply
 */
 static NTSTATUS find_fill_info(struct find_state *state,
@@ -707 +723 @@
         struct smb_trans2 *trans = state->op->trans;
         uint8_t *data;
-        uint_t ofs = trans->out.data.length;
+        unsigned int ofs = trans->out.data.length;
         uint32_t ea_size;
 
@@ -731 +747 @@
                 SIVAL(data, 16, file->standard.alloc_size);
                 SSVAL(data, 20, file->standard.attrib);
-                TRANS2_CHECK(smbsrv_blob_append_string(trans, &trans->out.data, file->standard.name.s, 
+                TRANS2_CHECK(smbsrv_blob_append_string(trans, &trans->out.data, file->standard.name.s,
                                                        ofs + 22, SMBSRV_REQ_DEFAULT_STR_FLAGS(req),
                                                        STR_LEN8BIT | STR_TERMINATE | STR_LEN_NOTERM));
@@ -752 +768 @@
                 SSVAL(data, 20, file->ea_size.attrib);
                 SIVAL(data, 22, file->ea_size.ea_size);
-                TRANS2_CHECK(smbsrv_blob_append_string(trans, &trans->out.data, file->ea_size.name.s, 
+                TRANS2_CHECK(smbsrv_blob_append_string(trans, &trans->out.data, file->ea_size.name.s,
                                                        ofs + 26, SMBSRV_REQ_DEFAULT_STR_FLAGS(req),
                                                        STR_LEN8BIT | STR_NOALIGN));
@@ -775 +791 @@
                 SSVAL(data, 20, file->ea_list.attrib);
                 ea_put_list(data+22, file->ea_list.eas.num_eas, file->ea_list.eas.eas);
-                TRANS2_CHECK(smbsrv_blob_append_string(trans, &trans->out.data, file->ea_list.name.s, 
+                TRANS2_CHECK(smbsrv_blob_append_string(trans, &trans->out.data, file->ea_list.name.s,
                                                        ofs + 22 + ea_size, SMBSRV_REQ_DEFAULT_STR_FLAGS(req),
                                                        STR_LEN8BIT | STR_NOALIGN));
@@ -803 +819 @@
         struct find_state *state = talloc_get_type(private_data, struct find_state);
         struct smb_trans2 *trans = state->op->trans;
-        uint_t old_length;
+        unsigned int old_length;
 
         old_length = trans->out.data.length;
@@ -845 +861 @@
 
 /*
+  fill a referral type structure
+ */
+static NTSTATUS fill_normal_dfs_referraltype(struct dfs_referral_type *ref,
+                                             uint16_t version,
+                                             const char *dfs_path,
+                                             const char *server_path, int isfirstoffset)
+{
+
+        switch (version) {
+        case 3:
+                ZERO_STRUCTP(ref);
+                ref->version = version;
+                ref->referral.v3.data.server_type = DFS_SERVER_NON_ROOT;
+                /* "normal" referral seems to always include the GUID */
+                ref->referral.v3.size = 34;
+
+                ref->referral.v3.data.entry_flags = 0;
+                ref->referral.v3.data.ttl = 600; /* As w2k3 */
+                ref->referral.v3.data.referrals.r1.DFS_path = dfs_path;
+                ref->referral.v3.data.referrals.r1.DFS_alt_path = dfs_path;
+                ref->referral.v3.data.referrals.r1.netw_address = server_path;
+                return NT_STATUS_OK;
+        case 4:
+                ZERO_STRUCTP(ref);
+                ref->version = version;
+                ref->referral.v4.server_type = DFS_SERVER_NON_ROOT;
+                /* "normal" referral seems to always include the GUID */
+                ref->referral.v4.size = 34;
+
+                if (isfirstoffset) {
+                        ref->referral.v4.entry_flags =  DFS_HEADER_FLAG_TARGET_BCK;
+                }
+                ref->referral.v4.ttl = 600; /* As w2k3 */
+                ref->referral.v4.r1.DFS_path = dfs_path;
+                ref->referral.v4.r1.DFS_alt_path = dfs_path;
+                ref->referral.v4.r1.netw_address = server_path;
+
+                return NT_STATUS_OK;
+        }
+        return NT_STATUS_INVALID_LEVEL;
+}
+
+/*
+  fill a domain refererral
+ */
+static NTSTATUS fill_domain_dfs_referraltype(struct dfs_referral_type *ref,
+                                             uint16_t version,
+                                             const char *domain,
+                                             const char **names,
+                                             uint16_t numnames)
+{
+        switch (version) {
+        case 3:
+                ZERO_STRUCTP(ref);
+                ref->version = version;
+                ref->referral.v3.data.server_type = DFS_SERVER_NON_ROOT;
+                /* It's hard coded ... don't think it's a good way but the sizeof return not the
+                 * correct values
+                 *
+                 * We have 18 if the GUID is not included 34 otherwise
+                */
+                ref->referral.v3.size = 18;
+                ref->referral.v3.data.entry_flags = DFS_FLAG_REFERRAL_DOMAIN_RESP;
+                ref->referral.v3.data.ttl = 600; /* As w2k3 */
+                ref->referral.v3.data.referrals.r2.special_name = domain;
+                ref->referral.v3.data.referrals.r2.nb_expanded_names = numnames;
+                /* Put the final terminator */
+                if (names) {
+                        const char **names2 = talloc_array(ref, const char *, numnames+1);
+                        NT_STATUS_HAVE_NO_MEMORY(names2);
+                        int i;
+                        for (i = 0; i<numnames; i++) {
+                                names2[i] = talloc_asprintf(names2, "\\%s", names[i]);
+                                NT_STATUS_HAVE_NO_MEMORY(names2[i]);
+                        }
+                        names2[numnames] = 0;
+                        ref->referral.v3.data.referrals.r2.expanded_names = names2;
+                }
+                return NT_STATUS_OK;
+        }
+        return NT_STATUS_INVALID_LEVEL;
+}
+
+/*
+  get the DCs list within a site
+ */
+static NTSTATUS get_dcs_insite(TALLOC_CTX *ctx, struct ldb_context *ldb,
+                               struct ldb_dn *sitedn, struct dc_set *list,
+                               bool dofqdn)
+{
+        static const char *attrs[] = { "serverReference", NULL };
+        static const char *attrs2[] = { "dNSHostName", "sAMAccountName", NULL };
+        struct ldb_result *r;
+        unsigned int i;
+        int ret;
+        const char **dc_list;
+
+        ret = ldb_search(ldb, ctx, &r, sitedn, LDB_SCOPE_SUBTREE, attrs,
+                         "(&(objectClass=server)(serverReference=*))");
+        if (ret != LDB_SUCCESS) {
+                DEBUG(2,(__location__ ": Failed to get list of servers - %s\n",
+                         ldb_errstring(ldb)));
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+
+        if (r->count == 0) {
+                /* none in this site */
+                talloc_free(r);
+                return NT_STATUS_OK;
+        }
+
+        /*
+         * need to search for all server object to know the size of the array.
+         * Search all the object of class server in this site
+         */
+        dc_list = talloc_array(r, const char *, r->count);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(dc_list, r);
+
+        /* TODO put some random here in the order */
+        list->names = talloc_realloc(list, list->names, const char *, list->count + r->count);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(list->names, r);
+
+        for (i = 0; i<r->count; i++) {
+                struct ldb_dn  *dn;
+                struct ldb_result *r2;
+
+                dn = ldb_msg_find_attr_as_dn(ldb, ctx, r->msgs[i], "serverReference");
+                if (!dn) {
+                        return NT_STATUS_INTERNAL_ERROR;
+                }
+
+                ret = ldb_search(ldb, r, &r2, dn, LDB_SCOPE_BASE, attrs2, "(objectClass=computer)");
+                if (ret != LDB_SUCCESS) {
+                        DEBUG(2,(__location__ ": Search for computer on %s failed - %s\n",
+                                 ldb_dn_get_linearized(dn), ldb_errstring(ldb)));
+                        return NT_STATUS_INTERNAL_ERROR;
+                }
+
+                if (dofqdn) {
+                        const char *dns = ldb_msg_find_attr_as_string(r2->msgs[0], "dNSHostName", NULL);
+                        if (dns == NULL) {
+                                DEBUG(2,(__location__ ": dNSHostName missing on %s\n",
+                                         ldb_dn_get_linearized(dn)));
+                                talloc_free(r);
+                                return NT_STATUS_INTERNAL_ERROR;
+                        }
+
+                        list->names[list->count] = talloc_strdup(list->names, dns);
+                        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(list->names[list->count], r);
+                } else {
+                        char *tmp;
+                        const char *acct = ldb_msg_find_attr_as_string(r2->msgs[0], "sAMAccountName", NULL);
+                        if (acct == NULL) {
+                                DEBUG(2,(__location__ ": sAMAccountName missing on %s\n",
+                                         ldb_dn_get_linearized(dn)));
+                                talloc_free(r);
+                                return NT_STATUS_INTERNAL_ERROR;
+                        }
+
+                        tmp = talloc_strdup(list->names, acct);
+                        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(tmp, r);
+
+                        /* Netbios name is also the sAMAccountName for
+                           computer but without the final $ */
+                        tmp[strlen(tmp) - 1] = '\0';
+                        list->names[list->count] = tmp;
+                }
+                list->count++;
+                talloc_free(r2);
+        }
+
+        talloc_free(r);
+        return NT_STATUS_OK;
+}
+
+
+/*
+  get all DCs
+ */
+static NTSTATUS get_dcs(TALLOC_CTX *ctx, struct ldb_context *ldb,
+                        const char *searched_site, bool need_fqdn,
+                        struct dc_set ***pset_list, uint32_t flags)
+{
+        /*
+         * Flags will be used later to indicate things like least-expensive
+         * or same-site options
+         */
+        const char *attrs_none[] = { NULL };
+        const char *attrs3[] = { "name", NULL };
+        struct ldb_dn *configdn, *sitedn, *dn, *sitescontainerdn;
+        struct ldb_result *r;
+        struct dc_set **set_list = NULL;
+        uint32_t i;
+        int ret;
+        uint32_t current_pos = 0;
+        NTSTATUS status;
+        TALLOC_CTX *subctx = talloc_new(ctx);
+
+        *pset_list = set_list = NULL;
+
+        subctx = talloc_new(ctx);
+        NT_STATUS_HAVE_NO_MEMORY(subctx);
+
+        configdn = ldb_get_config_basedn(ldb);
+
+        /* Let's search for the Site container */
+        ret = ldb_search(ldb, subctx, &r, configdn, LDB_SCOPE_SUBTREE, attrs_none,
+                         "(objectClass=sitesContainer)");
+        if (ret != LDB_SUCCESS) {
+                DEBUG(2,(__location__ ": Failed to find sitesContainer within %s - %s\n",
+                         ldb_dn_get_linearized(configdn), ldb_errstring(ldb)));
+                talloc_free(subctx);
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+        if (r->count > 1) {
+                DEBUG(2,(__location__ ": Expected 1 sitesContainer - found %u within %s\n",
+                         r->count, ldb_dn_get_linearized(configdn)));
+                talloc_free(subctx);
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+
+        sitescontainerdn = talloc_steal(subctx, r->msgs[0]->dn);
+        talloc_free(r);
+
+        /*
+         * TODO: Here we should have a more subtle handling
+         * for the case "same-site"
+         */
+        ret = ldb_search(ldb, subctx, &r, sitescontainerdn, LDB_SCOPE_SUBTREE,
+                         attrs_none, "(objectClass=server)");
+        if (ret != LDB_SUCCESS) {
+                DEBUG(2,(__location__ ": Failed to find servers within %s - %s\n",
+                         ldb_dn_get_linearized(sitescontainerdn), ldb_errstring(ldb)));
+                talloc_free(subctx);
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+        talloc_free(r);
+
+        if (searched_site != NULL) {
+                ret = ldb_search(ldb, subctx, &r, configdn, LDB_SCOPE_SUBTREE,
+                                 attrs_none, "(&(name=%s)(objectClass=site))", searched_site);
+                if (ret != LDB_SUCCESS) {
+                        talloc_free(subctx);
+                        return NT_STATUS_FOOBAR;
+                } else if (r->count != 1) {
+                        talloc_free(subctx);
+                        return NT_STATUS_FOOBAR;
+                }
+
+                /* All of this was to get the DN of the searched_site */
+                sitedn = r->msgs[0]->dn;
+
+                set_list = talloc_realloc(subctx, set_list, struct dc_set *, current_pos+1);
+                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(set_list, subctx);
+
+                set_list[current_pos] = talloc(set_list, struct dc_set);
+                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(set_list[current_pos], subctx);
+
+                set_list[current_pos]->names = NULL;
+                set_list[current_pos]->count = 0;
+                status = get_dcs_insite(subctx, ldb, sitedn,
+                                        set_list[current_pos], need_fqdn);
+                if (!NT_STATUS_IS_OK(status)) {
+                        DEBUG(2,(__location__ ": Failed to get DC from site %s - %s\n",
+                                 ldb_dn_get_linearized(sitedn), nt_errstr(status)));
+                        talloc_free(subctx);
+                        return status;
+                }
+                talloc_free(r);
+                current_pos++;
+        }
+
+        /* Let's find all the sites */
+        ret = ldb_search(ldb, subctx, &r, configdn, LDB_SCOPE_SUBTREE, attrs3, "(objectClass=site)");
+        if (ret != LDB_SUCCESS) {
+                DEBUG(2,(__location__ ": Failed to find any site containers in %s\n",
+                         ldb_dn_get_linearized(configdn)));
+                talloc_free(subctx);
+                return NT_STATUS_INTERNAL_DB_CORRUPTION;
+        }
+
+        /*
+         * TODO:
+         * We should randomize the order in the main site,
+         * it's mostly needed for sysvol/netlogon referral.
+         * Depending of flag we either randomize order of the
+         * not "in the same site DCs"
+         * or we randomize by group of site that have the same cost
+         * In the long run we want to manipulate an array of site_set
+         * All the site in one set have the same cost (if least-expansive options is selected)
+         * and we will put all the dc related to 1 site set into 1 DCs set.
+         * Within a site set, site order has to be randomized
+         *
+         * But for the moment we just return the list of sites
+         */
+        if (r->count) {
+                /*
+                 * We will realloc + 2 because we will need one additional place
+                 * for element at current_pos + 1 for the NULL element
+                 */
+                set_list = talloc_realloc(subctx, set_list, struct dc_set *,
+                                          current_pos+2);
+                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(set_list, subctx);
+
+                set_list[current_pos] = talloc(ctx, struct dc_set);
+                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(set_list[current_pos], subctx);
+
+                set_list[current_pos]->names = NULL;
+                set_list[current_pos]->count = 0;
+
+                set_list[current_pos+1] = NULL;
+        }
+
+        for (i=0; i<r->count; i++) {
+                const char *site_name = ldb_msg_find_attr_as_string(r->msgs[i], "name", NULL);
+                if (site_name == NULL) {
+                        DEBUG(2,(__location__ ": Failed to find name attribute in %s\n",
+                                 ldb_dn_get_linearized(r->msgs[i]->dn)));
+                        talloc_free(subctx);
+                        return NT_STATUS_INTERNAL_DB_CORRUPTION;
+                }
+
+                if (searched_site == NULL ||
+                    strcmp(searched_site, site_name) != 0) {
+                        DEBUG(2,(__location__ ": Site: %s %s\n",
+                                searched_site, site_name));
+
+                        /*
+                         * Do all the site but the one of the client
+                         * (because it has already been done ...)
+                         */
+                        dn = r->msgs[i]->dn;
+
+                        status = get_dcs_insite(subctx, ldb, dn,
+                                                set_list[current_pos],
+                                                need_fqdn);
+                        if (!NT_STATUS_IS_OK(status)) {
+                                talloc_free(subctx);
+                                return status;
+                        }
+                }
+        }
+        current_pos++;
+        set_list[current_pos] = NULL;
+
+        *pset_list = talloc_move(ctx, &set_list);
+        talloc_free(subctx);
+        return NT_STATUS_OK;
+}
+
+static NTSTATUS dodomain_referral(TALLOC_CTX *ctx,
+                                  const struct dfs_GetDFSReferral_in *dfsreq,
+                                  struct ldb_context *ldb,
+                                  struct smb_trans2 *trans,
+                                  struct loadparm_context *lp_ctx)
+{
+        /*
+         * TODO for the moment we just return the local domain
+         */
+        DATA_BLOB outblob;
+        enum ndr_err_code ndr_err;
+        NTSTATUS status;
+        const char *dns_domain = lpcfg_dnsdomain(lp_ctx);
+        const char *netbios_domain = lpcfg_workgroup(lp_ctx);
+        struct dfs_referral_resp resp;
+        struct dfs_referral_type *tab;
+        struct dfs_referral_type *referral;
+        const char *referral_str;
+        /* In the future this needs to be fetched from the ldb */
+        uint32_t found_domain = 2;
+        uint32_t current_pos = 0;
+        TALLOC_CTX *context;
+
+        if (lpcfg_server_role(lp_ctx) != ROLE_DOMAIN_CONTROLLER) {
+                DEBUG(10 ,("Received a domain referral request on a non DC\n"));
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
+        if (dfsreq->max_referral_level < 3) {
+                DEBUG(2,("invalid max_referral_level %u\n",
+                         dfsreq->max_referral_level));
+                return NT_STATUS_UNSUCCESSFUL;
+        }
+
+        context = talloc_new(ctx);
+        NT_STATUS_HAVE_NO_MEMORY(context);
+
+        resp.path_consumed = 0;
+        resp.header_flags = 0; /* Do like w2k3 */
+        resp.nb_referrals = found_domain; /* the fqdn one + the NT domain */
+
+        tab = talloc_array(context, struct dfs_referral_type, found_domain);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(tab, context);
+
+        referral = talloc(tab, struct dfs_referral_type);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(referral, context);
+        referral_str = talloc_asprintf(referral, "\\%s", netbios_domain);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(referral_str, context);
+        status = fill_domain_dfs_referraltype(referral,  3,
+                                              referral_str,
+                                              NULL, 0);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(2,(__location__ ":Unable to fill domain referral structure\n"));
+                talloc_free(context);
+                return NT_STATUS_UNSUCCESSFUL;
+        }
+
+        tab[current_pos] = *referral;
+        current_pos++;
+
+        referral = talloc(tab, struct dfs_referral_type);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(referral, context);
+        referral_str = talloc_asprintf(referral, "\\%s", dns_domain);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(referral_str, context);
+        status = fill_domain_dfs_referraltype(referral,  3,
+                                              referral_str,
+                                              NULL, 0);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(2,(__location__ ":Unable to fill domain referral structure\n"));
+                talloc_free(context);
+                return NT_STATUS_UNSUCCESSFUL;
+        }
+        tab[current_pos] = *referral;
+        current_pos++;
+
+        /*
+         * Put here the code from filling the array for trusted domain
+         */
+        resp.referral_entries = tab;
+
+        ndr_err = ndr_push_struct_blob(&outblob, context,
+                                &resp,
+                                (ndr_push_flags_fn_t)ndr_push_dfs_referral_resp);
+        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                DEBUG(2,(__location__ ":NDR marchalling of domain deferral response failed\n"));
+                talloc_free(context);
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+
+        if (outblob.length > trans->in.max_data) {
+                bool ok = false;
+
+                DEBUG(3, ("Blob is too big for the output buffer "
+                          "size %u max %u\n",
+                          (unsigned int)outblob.length, trans->in.max_data));
+
+                if (trans->in.max_data != MAX_DFS_RESPONSE) {
+                        /* As specified in MS-DFSC.pdf 3.3.5.2 */
+                        talloc_free(context);
+                        return STATUS_BUFFER_OVERFLOW;
+                }
+
+                /*
+                 * The answer is too big, so let's remove some answers
+                 */
+                while (!ok && resp.nb_referrals > 2) {
+                        data_blob_free(&outblob);
+
+                        /*
+                         * Let's scrap the first referral (for now)
+                         */
+                        resp.nb_referrals -= 1;
+                        resp.referral_entries += 1;
+
+                        ndr_err = ndr_push_struct_blob(&outblob, context,
+                                &resp,
+                                (ndr_push_flags_fn_t)ndr_push_dfs_referral_resp);
+                        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                                talloc_free(context);
+                                return NT_STATUS_INTERNAL_ERROR;
+                        }
+
+                        if (outblob.length <= MAX_DFS_RESPONSE) {
+                                DEBUG(10,("DFS: managed to reduce the size of referral initial"
+                                          "number of referral %d, actual count: %d",
+                                          found_domain, resp.nb_referrals));
+                                ok = true;
+                                break;
+                        }
+                }
+
+                if (!ok && resp.nb_referrals == 2) {
+                        DEBUG(0, (__location__ "; Not able to fit the domain and realm in DFS a "
+                                  " 56K buffer, something must be broken"));
+                        talloc_free(context);
+                        return NT_STATUS_INTERNAL_ERROR;
+                }
+        }
+
+        TRANS2_CHECK(trans2_setup_reply(trans, 0, outblob.length, 0));
+
+        trans->out.data = outblob;
+        talloc_steal(ctx, outblob.data);
+        talloc_free(context);
+        return NT_STATUS_OK;
+}
+
+/*
+ * Handle the logic for dfs referral request like \\domain
+ * or \\domain\sysvol or \\fqdn or \\fqdn\netlogon
+ */
+static NTSTATUS dodc_or_sysvol_referral(TALLOC_CTX *ctx,
+                                        const struct dfs_GetDFSReferral_in dfsreq,
+                                        const char* requestedname,
+                                        struct ldb_context *ldb,
+                                        struct smb_trans2 *trans,
+                                        struct smbsrv_request *req,
+                                        struct loadparm_context *lp_ctx)
+{
+        /*
+         * It's not a "standard" DFS referral but a referral to get the DC list
+         * or sysvol/netlogon
+         * Let's check that it's for one of our domain ...
+         */
+        DATA_BLOB outblob;
+        NTSTATUS status;
+        unsigned int num_domain = 1;
+        enum ndr_err_code ndr_err;
+        const char *requesteddomain;
+        const char *realm = lpcfg_realm(lp_ctx);
+        const char *domain = lpcfg_workgroup(lp_ctx);
+        const char *site_name = NULL; /* Name of the site where the client is */
+        char *share = NULL;
+        bool found = false;
+        bool need_fqdn = false;
+        bool dc_referral = true;
+        unsigned int i;
+        char *tmp;
+        struct dc_set **set;
+        char const **domain_list;
+        struct tsocket_address *remote_address;
+        char *client_addr = NULL;
+        TALLOC_CTX *context;
+
+        if (lpcfg_server_role(lp_ctx) != ROLE_DOMAIN_CONTROLLER) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
+        if (dfsreq.max_referral_level < 3) {
+                DEBUG(2,("invalid max_referral_level %u\n",
+                         dfsreq.max_referral_level));
+                return NT_STATUS_UNSUCCESSFUL;
+        }
+
+        context = talloc_new(ctx);
+        NT_STATUS_HAVE_NO_MEMORY(context);
+
+        if (requestedname[0] == '\\' && !strchr(requestedname+1,'\\')) {
+                requestedname++;
+        }
+        requesteddomain = requestedname;
+
+        if (strchr(requestedname,'\\')) {
+                char *subpart;
+                /* we have a second part */
+                requesteddomain = talloc_strdup(context, requestedname+1);
+                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(requesteddomain, context);
+                subpart = strchr(requesteddomain,'\\');
+                subpart[0] = '\0';
+        }
+        tmp = strchr(requestedname + 1,'\\'); /* To get second \ if any */
+
+        if (tmp != NULL) {
+                /* There was a share */
+                share = tmp+1;
+                dc_referral = false;
+        }
+
+        /*
+         * We will fetch the trusted domain list soon with something like this:
+         *
+         * "(&(|(flatname=%s)(cn=%s)(trustPartner=%s)(flatname=%s)(cn=%s)
+         * (trustPartner=%s))(objectclass=trustedDomain))"
+         *
+         * Allocate for num_domain + 1 so that the last element will be NULL)
+         */
+        domain_list = talloc_array(context, const char*, num_domain+1);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(domain_list, context);
+
+        domain_list[0] = realm;
+        domain_list[1] = domain;
+        for (i=0; i<=num_domain; i++) {
+                if (strncasecmp(domain_list[i], requesteddomain, strlen(domain_list[i])) == 0) {
+                        found = true;
+                        break;
+                }
+        }
+
+        if (!found) {
+                /* The requested domain is not one that we support */
+                DEBUG(3,("Requested referral for domain %s, but we don't handle it",
+                         requesteddomain));
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
+        if (strchr(requestedname,'.')) {
+                need_fqdn = 1;
+        }
+
+        remote_address = req->smb_conn->connection->remote_address;
+        if (tsocket_address_is_inet(remote_address, "ip")) {
+                client_addr = tsocket_address_inet_addr_string(remote_address, context);
+                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(client_addr, context);
+        }
+
+        status = get_dcs(context, ldb, site_name, need_fqdn, &set, 0);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(3,("Unable to get list of DCs\n"));
+                talloc_free(context);
+                return status;
+        }
+
+        if (dc_referral) {
+                const char **dc_list = NULL;
+                uint32_t num_dcs = 0;
+                struct dfs_referral_type *referral;
+                const char *referral_str;
+                struct dfs_referral_resp resp;
+
+                for(i=0; set[i]; i++) {
+                        uint32_t j;
+
+                        dc_list = talloc_realloc(context, dc_list, const char*,
+                                                 num_dcs + set[i]->count + 1);
+                        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(dc_list, context);
+
+                        for(j=0; j<set[i]->count; j++) {
+                                dc_list[num_dcs + j] = talloc_move(context, &set[i]->names[j]);
+                        }
+                        num_dcs = num_dcs + set[i]->count;
+                        TALLOC_FREE(set[i]);
+                        dc_list[num_dcs] = NULL;
+                }
+
+                resp.path_consumed = 0;
+                resp.header_flags = 0; /* Do like w2k3 and like in 3.3.5.3 of MS-DFSC*/
+
+                /*
+                 * The NumberOfReferrals field MUST be set to 1,
+                 * independent of the number of DC names
+                 * returned. (as stated in 3.3.5.3 of MS-DFSC)
+                 */
+                resp.nb_referrals = 1;
+
+                /* Put here the code from filling the array for trusted domain */
+                referral = talloc(context, struct dfs_referral_type);
+                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(referral, context);
+
+                referral_str = talloc_asprintf(referral, "\\%s",
+                                               requestedname);
+                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(referral_str, context);
+
+                status = fill_domain_dfs_referraltype(referral,  3,
+                                                referral_str,
+                                                dc_list, num_dcs);
+                if (!NT_STATUS_IS_OK(status)) {
+                        DEBUG(2,(__location__ ":Unable to fill domain referral structure\n"));
+                        talloc_free(context);
+                        return NT_STATUS_UNSUCCESSFUL;
+                }
+                resp.referral_entries = referral;
+
+                ndr_err = ndr_push_struct_blob(&outblob, context,
+                                &resp,
+                                (ndr_push_flags_fn_t)ndr_push_dfs_referral_resp);
+                if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                        DEBUG(2,(__location__ ":NDR marshalling of dfs referral response failed\n"));
+                        talloc_free(context);
+                        return NT_STATUS_INTERNAL_ERROR;
+                }
+        } else {
+                unsigned int nb_entries = 0;
+                unsigned int current = 0;
+                struct dfs_referral_type *tab;
+                struct dfs_referral_resp resp;
+
+                for(i=0; set[i]; i++) {
+                        nb_entries = nb_entries + set[i]->count;
+                }
+
+                resp.path_consumed = 2*strlen(requestedname); /* The length is expected in bytes */
+                resp.header_flags = DFS_HEADER_FLAG_STORAGE_SVR; /* Do like w2k3 and like in 3.3.5.3 of MS-DFSC*/
+
+                /*
+                 * The NumberOfReferrals field MUST be set to 1,
+                 * independent of the number of DC names
+                 * returned. (as stated in 3.3.5.3 of MS-DFSC)
+                 */
+                resp.nb_referrals = nb_entries;
+
+                tab = talloc_array(context, struct dfs_referral_type, nb_entries);
+                NT_STATUS_HAVE_NO_MEMORY(tab);
+
+                for(i=0; set[i]; i++) {
+                        uint32_t j;
+
+                        for(j=0; j< set[i]->count; j++) {
+                                struct dfs_referral_type *referral;
+                                const char *referral_str;
+
+                                referral = talloc(tab, struct dfs_referral_type);
+                                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(referral, context);
+
+                                referral_str = talloc_asprintf(referral, "\\%s\\%s",
+                                                               set[i]->names[j], share);
+                                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(referral_str, context);
+
+                                status = fill_normal_dfs_referraltype(referral,
+                                                dfsreq.max_referral_level,
+                                                requestedname, referral_str, j==0);
+                                if (!NT_STATUS_IS_OK(status)) {
+                                        DEBUG(2, (__location__ ": Unable to fill a normal dfs referral object"));
+                                        talloc_free(context);
+                                        return NT_STATUS_UNSUCCESSFUL;
+                                }
+                                tab[current] = *referral;
+                                current++;
+                        }
+                }
+                resp.referral_entries = tab;
+
+                ndr_err = ndr_push_struct_blob(&outblob, context,
+                                        &resp,
+                                        (ndr_push_flags_fn_t)ndr_push_dfs_referral_resp);
+                if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                        DEBUG(2,(__location__ ":NDR marchalling of domain deferral response failed\n"));
+                        talloc_free(context);
+                        return NT_STATUS_INTERNAL_ERROR;
+                }
+        }
+
+        TRANS2_CHECK(trans2_setup_reply(trans, 0, outblob.length, 0));
+
+        /*
+         * TODO If the size is too big we should remove
+         * some DC from the answer or return STATUS_BUFFER_OVERFLOW
+         */
+        trans->out.data = outblob;
+        talloc_steal(ctx, outblob.data);
+        talloc_free(context);
+        return NT_STATUS_OK;
+}
+
+/*
+  trans2 getdfsreferral implementation
+*/
+static NTSTATUS trans2_getdfsreferral(struct smbsrv_request *req,
+                                      struct trans_op *op)
+{
+        enum ndr_err_code ndr_err;
+        struct smb_trans2 *trans = op->trans;
+        struct dfs_GetDFSReferral_in dfsreq;
+        TALLOC_CTX *context;
+        struct ldb_context *ldb;
+        struct loadparm_context *lp_ctx;
+        const char *realm, *nbname, *requestedname;
+        char *fqdn, *tmp;
+        NTSTATUS status;
+
+        lp_ctx = req->tcon->ntvfs->lp_ctx;
+        if (!lpcfg_host_msdfs(lp_ctx)) {
+                return NT_STATUS_NOT_IMPLEMENTED;
+        }
+
+        context = talloc_new(req);
+        NT_STATUS_HAVE_NO_MEMORY(context);
+
+        ldb = samdb_connect(context, req->tcon->ntvfs->event_ctx, lp_ctx, system_session(lp_ctx), 0);
+        if (ldb == NULL) {
+                DEBUG(2,(__location__ ": Failed to open samdb\n"));
+                talloc_free(context);
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+
+        ndr_err = ndr_pull_struct_blob(&trans->in.params, op,
+                                       &dfsreq,
+                                       (ndr_pull_flags_fn_t)ndr_pull_dfs_GetDFSReferral_in);
+        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                status = ndr_map_error2ntstatus(ndr_err);
+                DEBUG(2,(__location__ ": Failed to parse GetDFSReferral_in - %s\n",
+                         nt_errstr(status)));
+                talloc_free(context);
+                return status;
+        }
+
+        DEBUG(10, ("Requested DFS name: %s length: %u\n",
+                   dfsreq.servername, (unsigned int)strlen(dfsreq.servername)));
+
+        /*
+         * If the servername is "" then we are in a case of domain dfs
+         * and the client just searches for the list of local domain
+         * it is attached and also trusted ones.
+         */
+        requestedname = dfsreq.servername;
+        if (requestedname == NULL || requestedname[0] == '\0') {
+                return dodomain_referral(op, &dfsreq, ldb, trans, lp_ctx);
+        }
+
+        realm = lpcfg_realm(lp_ctx);
+        nbname = lpcfg_netbios_name(lp_ctx);
+        fqdn = talloc_asprintf(context, "%s.%s", nbname, realm);
+
+        if ((strncasecmp(requestedname+1, nbname, strlen(nbname)) == 0) ||
+            (strncasecmp(requestedname+1, fqdn, strlen(fqdn)) == 0) ) {
+                /*
+                 * the referral request starts with \NETBIOSNAME or \fqdn
+                 * it's a standalone referral we do not do it
+                 * (TODO correct this)
+                 * If a DFS link that is a complete prefix of the DFS referral
+                 * request path is identified, the server MUST return a DFS link
+                 * referral response; otherwise, if it has a match for the DFS root,
+                 * it MUST return a root referral response.
+                 */
+                DEBUG(3, ("Received a standalone request for %s, we do not support standalone referral yet",requestedname));
+                talloc_free(context);
+                return NT_STATUS_NOT_FOUND;
+        }
+        talloc_free(fqdn);
+
+        tmp = strchr(requestedname + 1,'\\'); /* To get second \ if any */
+
+        /*
+         * If we have no slash at the first position or (foo.bar.domain.net)
+         * a slash at the first position but no other slash (\foo.bar.domain.net)
+         * or a slash at the first position and another slash
+         * and netlogon or sysvol after the second slash
+         * (\foo.bar.domain.net\sysvol) then we will handle it because
+         * it's either a dc referral or a sysvol/netlogon referral
+         */
+        if (requestedname[0] != '\\' ||
+            tmp == NULL ||
+            strcasecmp(tmp+1, "sysvol") == 0 ||
+            strcasecmp(tmp+1, "netlogon") == 0) {
+                status = dodc_or_sysvol_referral(op, dfsreq, requestedname,
+                                               ldb, trans, req, lp_ctx);
+                talloc_free(context);
+                return status;
+        }
+
+        if (requestedname[0] == '\\' &&
+            tmp &&
+            strchr(tmp+1, '\\') &&
+            (strncasecmp(tmp+1, "sysvol", 6) == 0 ||
+             strncasecmp(tmp+1, "netlogon", 8) == 0)) {
+                /*
+                 * We have more than two \ so it something like
+                 * \domain\sysvol\foobar
+                 */
+                talloc_free(context);
+                return NT_STATUS_NOT_FOUND;
+        }
+
+        talloc_free(context);
+        /* By default until all the case are handled*/
+        return NT_STATUS_NOT_FOUND;
+}
+
+/*
   trans2 findfirst implementation
 */
@@ -881 +1755 @@
         if (search->t2ffirst.data_level == RAW_SEARCH_DATA_EA_LIST) {
                 TRANS2_CHECK(ea_pull_name_list(&trans->in.data, req,
-                                               &search->t2ffirst.in.num_names, 
+                                               &search->t2ffirst.in.num_names,
                                                &search->t2ffirst.in.ea_names));
         }
@@ -967 +1841 @@
         if (search->t2fnext.data_level == RAW_SEARCH_DATA_EA_LIST) {
                 TRANS2_CHECK(ea_pull_name_list(&trans->in.data, req,
-                                               &search->t2fnext.in.num_names, 
+                                               &search->t2fnext.in.num_names,
                                                &search->t2fnext.in.ea_names));
         }
@@ -1011 +1885 @@
         /* the trans2 command is in setup[0] */
         switch (trans->in.setup[0]) {
+        case TRANSACT2_GET_DFS_REFERRAL:
+                return trans2_getdfsreferral(req, op);
         case TRANSACT2_FINDFIRST:
                 return trans2_findfirst(req, op);
@@ -1117 +1993 @@
         do {
                 uint16_t this_data, this_param, max_bytes;
-                uint_t align1 = 1, align2 = (params_left ? 2 : 0);
+                unsigned int align1 = 1, align2 = (params_left ? 2 : 0);
                 struct smbsrv_request *this_req;
 
@@ -1134 +2010 @@
 
                 /* don't destroy unless this is the last chunk */
-                if (params_left - this_param != 0 || 
+                if (params_left - this_param != 0 ||
                     data_left - this_data != 0) {
                         this_req = smbsrv_setup_secondary_request(req);
@@ -1152 +2028 @@
 
                 SSVAL(this_req->out.vwv, VWV(6), this_data);
-                SSVAL(this_req->out.vwv, VWV(7), align1 + align2 + 
+                SSVAL(this_req->out.vwv, VWV(7), align1 + align2 +
                       PTR_DIFF(this_req->out.data + this_param, this_req->out.hdr));
                 SSVAL(this_req->out.vwv, VWV(8), PTR_DIFF(data, trans->out.data.data));
@@ -1342 +2218 @@
         if ((param_count != 0 &&
              param_disp != trans->in.params.length) ||
-            (data_count != 0 && 
+            (data_count != 0 &&
              data_disp != trans->in.data.length)) {
                 smbsrv_send_error(req, NT_STATUS_INVALID_PARAMETER);
@@ -1350 +2226 @@
         /* add to the existing request */
         if (param_count != 0) {
-                trans->in.params.data = talloc_realloc(trans, 
-                                                         trans->in.params.data, 
-                                                         uint8_t, 
+                trans->in.params.data = talloc_realloc(trans,
+                                                         trans->in.params.data,
+                                                         uint8_t,
                                                          param_disp + param_count);
                 if (trans->in.params.data == NULL) {
@@ -1362 +2238 @@
 
         if (data_count != 0) {
-                trans->in.data.data = talloc_realloc(trans, 
-                                                       trans->in.data.data, 
-                                                       uint8_t, 
+                trans->in.data.data = talloc_realloc(trans,
+                                                       trans->in.data.data,
+                                                       uint8_t,
                                                        data_disp + data_count);
                 if (trans->in.data.data == NULL) {