2 Unix SMB/CIFS implementation.
3 service (connection) opening and closing
4 Copyright (C) Andrew Tridgell 1992-1998
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 #include "system/filesys.h"
22 #include "system/passwd.h" /* uid_wrapper */
23 #include "../lib/tsocket/tsocket.h"
24 #include "smbd/smbd.h"
25 #include "smbd/globals.h"
26 #include "../librpc/gen_ndr/netlogon.h"
27 #include "../libcli/security/security.h"
28 #include "printing/pcap.h"
29 #include "passdb/lookup_sid.h"
31 #include "lib/param/loadparm.h"
33 #include "lib/afs/afs_funcs.h"
34 #include "lib/util_path.h"
36 static bool canonicalize_connect_path(connection_struct
*conn
)
39 char *resolved_name
= SMB_VFS_REALPATH(conn
,conn
->connectpath
);
43 ret
= set_conn_connectpath(conn
,resolved_name
);
44 SAFE_FREE(resolved_name
);
48 /****************************************************************************
49 Ensure when setting connectpath it is a canonicalized (no ./ // or ../)
50 absolute path stating in / and not ending in /.
51 ****************************************************************************/
53 bool set_conn_connectpath(connection_struct
*conn
, const char *connectpath
)
57 if (connectpath
== NULL
|| connectpath
[0] == '\0') {
61 destname
= canonicalize_absolute_path(conn
, connectpath
);
62 if (destname
== NULL
) {
66 DEBUG(10,("set_conn_connectpath: service %s, connectpath = %s\n",
67 lp_servicename(talloc_tos(), SNUM(conn
)), destname
));
69 talloc_free(conn
->connectpath
);
70 conn
->connectpath
= destname
;
71 /* Ensure conn->cwd is initialized - start as conn->connectpath. */
72 TALLOC_FREE(conn
->cwd
);
73 conn
->cwd
= talloc_strdup(conn
, conn
->connectpath
);
80 /****************************************************************************
81 Load parameters specific to a connection/service.
82 ****************************************************************************/
84 bool set_current_service(connection_struct
*conn
, uint16_t flags
, bool do_chdir
)
87 enum remote_arch_types ra_type
;
94 conn
->lastused_count
++;
99 struct smb_filename connectpath_fname
= {
100 .base_name
= conn
->connectpath
102 struct smb_filename origpath_fname
= {
103 .base_name
= conn
->origpath
107 vfs_ChDir(conn
, &connectpath_fname
) != 0 &&
108 vfs_ChDir(conn
, &origpath_fname
) != 0) {
109 DEBUG(((errno
!=EACCES
)?0:3),
110 ("chdir (%s) failed, reason: %s\n",
111 conn
->connectpath
, strerror(errno
)));
116 if ((conn
== last_conn
) && (last_flags
== flags
)) {
124 * Obey the client case sensitivity requests - only for clients that
126 switch (lp_case_sensitive(snum
)) {
129 * We need this uglyness due to DOS/Win9x clients that lie
130 * about case insensitivity. */
131 ra_type
= get_remote_arch();
132 if (conn
->sconn
->using_smb2
) {
133 conn
->case_sensitive
= false;
134 } else if ((ra_type
!= RA_SAMBA
) && (ra_type
!= RA_CIFSFS
)) {
136 * Client can't support per-packet case sensitive
138 conn
->case_sensitive
= false;
140 conn
->case_sensitive
=
141 !(flags
& FLAG_CASELESS_PATHNAMES
);
145 conn
->case_sensitive
= true;
148 conn
->case_sensitive
= false;
154 /****************************************************************************
155 do some basic sainity checks on the share.
156 This function modifies dev, ecode.
157 ****************************************************************************/
159 static NTSTATUS
share_sanity_checks(const struct tsocket_address
*remote_address
,
166 raddr
= tsocket_address_inet_addr_string(remote_address
,
169 return NT_STATUS_NO_MEMORY
;
172 if (!lp_snum_ok(snum
) ||
173 !allow_access(lp_hosts_deny(snum
), lp_hosts_allow(snum
),
175 return NT_STATUS_ACCESS_DENIED
;
178 if (dev
[0] == '?' || !dev
[0]) {
179 if (lp_printable(snum
)) {
180 fstrcpy(dev
,"LPT1:");
181 } else if (strequal(lp_fstype(snum
), "IPC")) {
188 if (!strupper_m(dev
)) {
189 DEBUG(2,("strupper_m %s failed\n", dev
));
190 return NT_STATUS_INVALID_PARAMETER
;
193 if (lp_printable(snum
)) {
194 if (!strequal(dev
, "LPT1:")) {
195 return NT_STATUS_BAD_DEVICE_TYPE
;
197 } else if (strequal(lp_fstype(snum
), "IPC")) {
198 if (!strequal(dev
, "IPC")) {
199 return NT_STATUS_BAD_DEVICE_TYPE
;
201 } else if (!strequal(dev
, "A:")) {
202 return NT_STATUS_BAD_DEVICE_TYPE
;
205 /* Behave as a printer if we are supposed to */
206 if (lp_printable(snum
) && (strcmp(dev
, "A:") == 0)) {
207 fstrcpy(dev
, "LPT1:");
214 * Go through lookup_name etc to find the force'd group.
216 * Create a new token from src_token, replacing the primary group sid with the
220 static NTSTATUS
find_forced_group(bool force_user
,
221 int snum
, const char *username
,
222 struct dom_sid
*pgroup_sid
,
225 NTSTATUS result
= NT_STATUS_NO_SUCH_GROUP
;
226 TALLOC_CTX
*frame
= talloc_stackframe();
227 struct dom_sid group_sid
;
228 enum lsa_SidType type
;
230 bool user_must_be_member
= False
;
233 groupname
= lp_force_group(talloc_tos(), snum
);
234 if (groupname
== NULL
) {
235 DEBUG(1, ("talloc_strdup failed\n"));
236 result
= NT_STATUS_NO_MEMORY
;
240 if (groupname
[0] == '+') {
241 user_must_be_member
= True
;
245 groupname
= talloc_string_sub(talloc_tos(), groupname
,
246 "%S", lp_servicename(talloc_tos(), snum
));
247 if (groupname
== NULL
) {
248 DEBUG(1, ("talloc_string_sub failed\n"));
249 result
= NT_STATUS_NO_MEMORY
;
253 if (!lookup_name_smbconf(talloc_tos(), groupname
,
254 LOOKUP_NAME_ALL
|LOOKUP_NAME_GROUP
,
255 NULL
, NULL
, &group_sid
, &type
)) {
256 DEBUG(10, ("lookup_name_smbconf(%s) failed\n",
261 if ((type
!= SID_NAME_DOM_GRP
) && (type
!= SID_NAME_ALIAS
) &&
262 (type
!= SID_NAME_WKN_GRP
)) {
263 DEBUG(10, ("%s is a %s, not a group\n", groupname
,
264 sid_type_lookup(type
)));
268 if (!sid_to_gid(&group_sid
, &gid
)) {
269 DEBUG(10, ("sid_to_gid(%s) for %s failed\n",
270 sid_string_dbg(&group_sid
), groupname
));
275 * If the user has been forced and the forced group starts with a '+',
276 * then we only set the group to be the forced group if the forced
277 * user is a member of that group. Otherwise, the meaning of the '+'
281 if (force_user
&& user_must_be_member
) {
282 if (user_in_group_sid(username
, &group_sid
)) {
283 sid_copy(pgroup_sid
, &group_sid
);
285 DEBUG(3,("Forced group %s for member %s\n",
286 groupname
, username
));
288 DEBUG(0,("find_forced_group: forced user %s is not a member "
289 "of forced group %s. Disallowing access.\n",
290 username
, groupname
));
291 result
= NT_STATUS_MEMBER_NOT_IN_GROUP
;
295 sid_copy(pgroup_sid
, &group_sid
);
297 DEBUG(3,("Forced group %s\n", groupname
));
300 result
= NT_STATUS_OK
;
306 /****************************************************************************
307 Create an auth_session_info structure for a connection_struct
308 ****************************************************************************/
310 static NTSTATUS
create_connection_session_info(struct smbd_server_connection
*sconn
,
311 TALLOC_CTX
*mem_ctx
, int snum
,
312 struct auth_session_info
*session_info
,
313 struct auth_session_info
**presult
)
315 struct auth_session_info
*result
;
317 if (lp_guest_only(snum
)) {
318 return make_session_info_guest(mem_ctx
, presult
);
322 * This is the normal security != share case where we have a
323 * valid vuid from the session setup. */
325 if (security_session_user_level(session_info
, NULL
) < SECURITY_USER
) {
326 if (!lp_guest_ok(snum
)) {
327 DEBUG(2, ("guest user (from session setup) "
328 "not permitted to access this share "
329 "(%s)\n", lp_servicename(talloc_tos(), snum
)));
330 return NT_STATUS_ACCESS_DENIED
;
333 if (!user_ok_token(session_info
->unix_info
->unix_name
,
334 session_info
->info
->domain_name
,
335 session_info
->security_token
, snum
)) {
336 DEBUG(2, ("user '%s' (from session setup) not "
337 "permitted to access this share "
339 session_info
->unix_info
->unix_name
,
340 lp_servicename(talloc_tos(), snum
)));
341 return NT_STATUS_ACCESS_DENIED
;
345 result
= copy_session_info(mem_ctx
, session_info
);
346 if (result
== NULL
) {
347 return NT_STATUS_NO_MEMORY
;
354 /****************************************************************************
355 Set relevant user and group settings corresponding to force user/group
356 configuration for the given snum.
357 ****************************************************************************/
359 NTSTATUS
set_conn_force_user_group(connection_struct
*conn
, int snum
)
363 if (*lp_force_user(talloc_tos(), snum
)) {
366 * Replace conn->session_info with a completely faked up one
367 * from the username we are forced into :-)
371 char *sanitized_username
;
372 struct auth_session_info
*forced_serverinfo
;
375 fuser
= talloc_string_sub(conn
, lp_force_user(talloc_tos(), snum
), "%S",
376 lp_const_servicename(snum
));
378 return NT_STATUS_NO_MEMORY
;
381 guest
= security_session_user_level(conn
->session_info
, NULL
) < SECURITY_USER
;
383 status
= make_session_info_from_username(
387 if (!NT_STATUS_IS_OK(status
)) {
391 /* We don't want to replace the original sanitized_username
392 as it is the original user given in the connect attempt.
393 This is used in '%U' substitutions. */
394 sanitized_username
= discard_const_p(char,
395 forced_serverinfo
->unix_info
->sanitized_username
);
396 TALLOC_FREE(sanitized_username
);
397 forced_serverinfo
->unix_info
->sanitized_username
=
398 talloc_move(forced_serverinfo
->unix_info
,
399 &conn
->session_info
->unix_info
->sanitized_username
);
401 TALLOC_FREE(conn
->session_info
);
402 conn
->session_info
= forced_serverinfo
;
404 conn
->force_user
= true;
405 DEBUG(3,("Forced user %s\n", fuser
));
409 * If force group is true, then override
410 * any groupid stored for the connecting user.
413 if (*lp_force_group(talloc_tos(), snum
)) {
415 status
= find_forced_group(
416 conn
->force_user
, snum
, conn
->session_info
->unix_info
->unix_name
,
417 &conn
->session_info
->security_token
->sids
[1],
418 &conn
->session_info
->unix_token
->gid
);
420 if (!NT_STATUS_IS_OK(status
)) {
425 * We need to cache this gid, to use within
426 * change_to_user() separately from the conn->session_info
427 * struct. We only use conn->session_info directly if
428 * "force_user" was set.
430 conn
->force_group_gid
= conn
->session_info
->unix_token
->gid
;
436 static NTSTATUS
notify_init_sconn(struct smbd_server_connection
*sconn
)
440 if (sconn
->notify_ctx
!= NULL
) {
444 sconn
->notify_ctx
= notify_init(sconn
, sconn
->msg_ctx
, sconn
->ev_ctx
,
445 sconn
, notify_callback
);
446 if (sconn
->notify_ctx
== NULL
) {
447 return NT_STATUS_NO_MEMORY
;
450 status
= messaging_register(sconn
->msg_ctx
, sconn
,
451 MSG_SMB_NOTIFY_CANCEL_DELETED
,
452 smbd_notify_cancel_deleted
);
453 if (!NT_STATUS_IS_OK(status
)) {
454 DBG_DEBUG("messaging_register failed: %s\n",
456 TALLOC_FREE(sconn
->notify_ctx
);
460 status
= messaging_register(sconn
->msg_ctx
, sconn
,
461 MSG_SMB_NOTIFY_STARTED
,
462 smbd_notifyd_restarted
);
463 if (!NT_STATUS_IS_OK(status
)) {
464 DBG_DEBUG("messaging_register failed: %s\n",
466 messaging_deregister(sconn
->msg_ctx
,
467 MSG_SMB_NOTIFY_CANCEL_DELETED
, sconn
);
468 TALLOC_FREE(sconn
->notify_ctx
);
475 /****************************************************************************
476 Make a connection, given the snum to connect to, and the vuser of the
477 connecting user if appropriate.
478 ****************************************************************************/
480 static NTSTATUS
make_connection_snum(struct smbXsrv_connection
*xconn
,
481 connection_struct
*conn
,
482 int snum
, struct user_struct
*vuser
,
485 struct smbd_server_connection
*sconn
= xconn
->client
->sconn
;
486 struct smb_filename
*smb_fname_cpath
= NULL
;
489 bool on_err_call_dis_hook
= false;
496 status
= share_sanity_checks(sconn
->remote_address
,
497 sconn
->remote_hostname
,
500 if (NT_STATUS_IS_ERR(status
)) {
504 conn
->params
->service
= snum
;
506 status
= create_connection_session_info(sconn
,
507 conn
, snum
, vuser
->session_info
,
508 &conn
->session_info
);
510 if (!NT_STATUS_IS_OK(status
)) {
511 DEBUG(1, ("create_connection_session_info failed: %s\n",
516 if (lp_guest_only(snum
)) {
517 conn
->force_user
= true;
520 conn
->num_files_open
= 0;
521 conn
->lastused
= conn
->lastused_count
= time(NULL
);
522 conn
->printer
= (strncmp(dev
,"LPT",3) == 0);
523 conn
->ipc
= ( (strncmp(dev
,"IPC",3) == 0) ||
524 ( lp_enable_asu_support() && strequal(dev
,"ADMIN$")) );
526 /* Case options for the share. */
527 if (lp_case_sensitive(snum
) == Auto
) {
528 /* We will be setting this per packet. Set to be case
529 * insensitive for now. */
530 conn
->case_sensitive
= False
;
532 conn
->case_sensitive
= (bool)lp_case_sensitive(snum
);
535 conn
->case_preserve
= lp_preserve_case(snum
);
536 conn
->short_case_preserve
= lp_short_preserve_case(snum
);
538 conn
->encrypt_level
= lp_smb_encrypt(snum
);
539 if (conn
->encrypt_level
> SMB_SIGNING_OFF
) {
540 if (lp_smb_encrypt(-1) == SMB_SIGNING_OFF
) {
541 if (conn
->encrypt_level
== SMB_SIGNING_REQUIRED
) {
542 DBG_ERR("Service [%s] requires encryption, but "
543 "it is disabled globally!\n",
544 lp_servicename(talloc_tos(), snum
));
545 status
= NT_STATUS_ACCESS_DENIED
;
548 conn
->encrypt_level
= SMB_SIGNING_OFF
;
552 conn
->veto_list
= NULL
;
553 conn
->hide_list
= NULL
;
554 conn
->veto_oplock_list
= NULL
;
555 conn
->aio_write_behind_list
= NULL
;
557 conn
->read_only
= lp_read_only(SNUM(conn
));
559 status
= set_conn_force_user_group(conn
, snum
);
560 if (!NT_STATUS_IS_OK(status
)) {
564 conn
->vuid
= vuser
->vuid
;
567 char *s
= talloc_sub_advanced(talloc_tos(),
568 lp_servicename(talloc_tos(), SNUM(conn
)),
569 conn
->session_info
->unix_info
->unix_name
,
571 conn
->session_info
->unix_token
->gid
,
572 conn
->session_info
->unix_info
->sanitized_username
,
573 conn
->session_info
->info
->domain_name
,
574 lp_path(talloc_tos(), snum
));
576 status
= NT_STATUS_NO_MEMORY
;
580 if (!set_conn_connectpath(conn
,s
)) {
582 status
= NT_STATUS_NO_MEMORY
;
585 DEBUG(3,("Connect path is '%s' for service [%s]\n",s
,
586 lp_servicename(talloc_tos(), snum
)));
591 * Set up the share security descriptor.
592 * NOTE - we use the *INCOMING USER* session_info
593 * here, as does (indirectly) change_to_user(),
594 * which can be called on any incoming packet.
595 * This way we set up the share access based
596 * on the authenticated user, not the forced
599 * https://bugzilla.samba.org/show_bug.cgi?id=9878
602 status
= check_user_share_access(conn
,
606 if (!NT_STATUS_IS_OK(status
)) {
610 /* Initialise VFS function pointers */
612 if (!smbd_vfs_init(conn
)) {
613 DEBUG(0, ("vfs_init failed for service %s\n",
614 lp_servicename(talloc_tos(), snum
)));
615 status
= NT_STATUS_BAD_NETWORK_NAME
;
619 /* ROOT Activities: */
620 /* explicitly check widelinks here so that we can correctly warn
622 widelinks_warning(snum
);
625 * Enforce the max connections parameter.
628 if ((lp_max_connections(snum
) > 0)
629 && (count_current_connections(lp_servicename(talloc_tos(), SNUM(conn
)), True
) >=
630 lp_max_connections(snum
))) {
632 DEBUG(1, ("Max connections (%d) exceeded for %s\n",
633 lp_max_connections(snum
),
634 lp_servicename(talloc_tos(), snum
)));
635 status
= NT_STATUS_INSUFFICIENT_RESOURCES
;
639 /* Invoke VFS make connection hook - this must be the first
640 filesystem operation that we do. */
642 if (SMB_VFS_CONNECT(conn
, lp_servicename(talloc_tos(), snum
),
643 conn
->session_info
->unix_info
->unix_name
) < 0) {
644 DBG_WARNING("SMB_VFS_CONNECT for service '%s' at '%s' failed: %s\n",
645 lp_servicename(talloc_tos(), snum
), conn
->connectpath
,
647 status
= NT_STATUS_UNSUCCESSFUL
;
651 /* Any error exit after here needs to call the disconnect hook. */
652 on_err_call_dis_hook
= true;
654 if ((!conn
->printer
) && (!conn
->ipc
) &&
655 lp_change_notify()) {
657 status
= notify_init_sconn(sconn
);
658 if (!NT_STATUS_IS_OK(status
)) {
663 if (lp_kernel_oplocks(snum
)) {
664 init_kernel_oplocks(conn
->sconn
);
668 * Fix compatibility issue pointed out by Volker.
669 * We pass the conn->connectpath to the preexec
670 * scripts as a parameter, so attempt to canonicalize
671 * it here before calling the preexec scripts.
672 * We ignore errors here, as it is possible that
673 * the conn->connectpath doesn't exist yet and
674 * the preexec scripts will create them.
677 (void)canonicalize_connect_path(conn
);
679 /* Preexecs are done here as they might make the dir we are to ChDir
681 /* execute any "root preexec = " line */
682 if (*lp_root_preexec(talloc_tos(), snum
)) {
683 char *cmd
= talloc_sub_advanced(talloc_tos(),
684 lp_servicename(talloc_tos(), SNUM(conn
)),
685 conn
->session_info
->unix_info
->unix_name
,
687 conn
->session_info
->unix_token
->gid
,
688 conn
->session_info
->unix_info
->sanitized_username
,
689 conn
->session_info
->info
->domain_name
,
690 lp_root_preexec(talloc_tos(), snum
));
691 DEBUG(5,("cmd=%s\n",cmd
));
692 ret
= smbrun(cmd
, NULL
, NULL
);
694 if (ret
!= 0 && lp_root_preexec_close(snum
)) {
695 DEBUG(1,("root preexec gave %d - failing "
696 "connection\n", ret
));
697 status
= NT_STATUS_ACCESS_DENIED
;
702 /* USER Activites: */
703 if (!change_to_user(conn
, conn
->vuid
)) {
704 /* No point continuing if they fail the basic checks */
705 DEBUG(0,("Can't become connected user!\n"));
706 status
= NT_STATUS_LOGON_FAILURE
;
713 /* Remember that a different vuid can connect later without these
716 /* Preexecs are done here as they might make the dir we are to ChDir
719 /* execute any "preexec = " line */
720 if (*lp_preexec(talloc_tos(), snum
)) {
721 char *cmd
= talloc_sub_advanced(talloc_tos(),
722 lp_servicename(talloc_tos(), SNUM(conn
)),
723 conn
->session_info
->unix_info
->unix_name
,
725 conn
->session_info
->unix_token
->gid
,
726 conn
->session_info
->unix_info
->sanitized_username
,
727 conn
->session_info
->info
->domain_name
,
728 lp_preexec(talloc_tos(), snum
));
729 ret
= smbrun(cmd
, NULL
, NULL
);
731 if (ret
!= 0 && lp_preexec_close(snum
)) {
732 DEBUG(1,("preexec gave %d - failing connection\n",
734 status
= NT_STATUS_ACCESS_DENIED
;
739 #ifdef WITH_FAKE_KASERVER
740 if (lp_afs_share(snum
)) {
746 * we've finished with the user stuff - go back to root
747 * so the SMB_VFS_STAT call will only fail on path errors,
748 * not permission problems.
750 change_to_root_user();
751 /* ROOT Activites: */
754 * If widelinks are disallowed we need to canonicalise the connect
755 * path here to ensure we don't have any symlinks in the
756 * connectpath. We will be checking all paths on this connection are
757 * below this directory. We must do this after the VFS init as we
758 * depend on the realpath() pointer in the vfs table. JRA.
760 if (!lp_widelinks(snum
)) {
761 if (!canonicalize_connect_path(conn
)) {
762 DEBUG(0, ("canonicalize_connect_path failed "
763 "for service %s, path %s\n",
764 lp_servicename(talloc_tos(), snum
),
766 status
= NT_STATUS_BAD_NETWORK_NAME
;
771 /* Add veto/hide lists */
772 if (!IS_IPC(conn
) && !IS_PRINT(conn
)) {
773 set_namearray( &conn
->veto_list
,
774 lp_veto_files(talloc_tos(), snum
));
775 set_namearray( &conn
->hide_list
,
776 lp_hide_files(talloc_tos(), snum
));
777 set_namearray( &conn
->veto_oplock_list
,
778 lp_veto_oplock_files(talloc_tos(), snum
));
779 set_namearray( &conn
->aio_write_behind_list
,
780 lp_aio_write_behind(talloc_tos(), snum
));
782 smb_fname_cpath
= synthetic_smb_fname(talloc_tos(),
787 if (smb_fname_cpath
== NULL
) {
788 status
= NT_STATUS_NO_MEMORY
;
792 /* win2000 does not check the permissions on the directory
793 during the tree connect, instead relying on permission
794 check during individual operations. To match this behaviour
795 I have disabled this chdir check (tridge) */
796 /* the alternative is just to check the directory exists */
798 if ((ret
= SMB_VFS_STAT(conn
, smb_fname_cpath
)) != 0 ||
799 !S_ISDIR(smb_fname_cpath
->st
.st_ex_mode
)) {
800 if (ret
== 0 && !S_ISDIR(smb_fname_cpath
->st
.st_ex_mode
)) {
801 DEBUG(0,("'%s' is not a directory, when connecting to "
802 "[%s]\n", conn
->connectpath
,
803 lp_servicename(talloc_tos(), snum
)));
805 DEBUG(0,("'%s' does not exist or permission denied "
806 "when connecting to [%s] Error was %s\n",
808 lp_servicename(talloc_tos(), snum
),
811 status
= NT_STATUS_BAD_NETWORK_NAME
;
814 conn
->base_share_dev
= smb_fname_cpath
->st
.st_ex_dev
;
816 talloc_free(conn
->origpath
);
817 conn
->origpath
= talloc_strdup(conn
, conn
->connectpath
);
819 /* Figure out the characteristics of the underlying filesystem. This
820 * assumes that all the filesystem mounted withing a share path have
821 * the same characteristics, which is likely but not guaranteed.
824 conn
->fs_capabilities
= SMB_VFS_FS_CAPABILITIES(conn
, &conn
->ts_res
);
827 * Print out the 'connected as' stuff here as we need
828 * to know the effective uid and gid we will be using
829 * (at least initially).
832 if( DEBUGLVL( IS_IPC(conn
) ? 3 : 2 ) ) {
833 dbgtext( "%s (%s) ", get_remote_machine_name(),
834 tsocket_address_string(conn
->sconn
->remote_address
,
836 dbgtext( "%s", srv_is_signing_active(xconn
) ? "signed " : "");
837 dbgtext( "connect to service %s ",
838 lp_servicename(talloc_tos(), snum
) );
839 dbgtext( "initially as user %s ",
840 conn
->session_info
->unix_info
->unix_name
);
841 dbgtext( "(uid=%d, gid=%d) ", (int)effuid
, (int)effgid
);
842 dbgtext( "(pid %d)\n", (int)getpid() );
849 TALLOC_FREE(smb_fname_cpath
);
850 /* We must exit this function as root. */
851 if (geteuid() != 0) {
852 change_to_root_user();
854 if (on_err_call_dis_hook
) {
855 /* Call VFS disconnect hook */
856 SMB_VFS_DISCONNECT(conn
);
861 /****************************************************************************
862 Make a connection to a service from SMB1. Internal interface.
863 ****************************************************************************/
865 static connection_struct
*make_connection_smb1(struct smb_request
*req
,
867 int snum
, struct user_struct
*vuser
,
871 struct smbXsrv_tcon
*tcon
;
873 struct connection_struct
*conn
;
875 status
= smb1srv_tcon_create(req
->xconn
, now
, &tcon
);
876 if (!NT_STATUS_IS_OK(status
)) {
877 DEBUG(0,("make_connection_smb1: Couldn't find free tcon %s.\n",
883 conn
= conn_new(req
->sconn
);
887 DEBUG(0,("make_connection_smb1: Couldn't find free connection.\n"));
888 *pstatus
= NT_STATUS_INSUFFICIENT_RESOURCES
;
892 conn
->cnum
= tcon
->global
->tcon_wire_id
;
895 *pstatus
= make_connection_snum(req
->xconn
,
900 if (!NT_STATUS_IS_OK(*pstatus
)) {
906 tcon
->global
->share_name
= lp_servicename(tcon
->global
, SNUM(conn
));
907 if (tcon
->global
->share_name
== NULL
) {
910 *pstatus
= NT_STATUS_NO_MEMORY
;
913 tcon
->global
->session_global_id
=
914 vuser
->session
->global
->session_global_id
;
916 tcon
->compat
= talloc_move(tcon
, &conn
);
917 tcon
->status
= NT_STATUS_OK
;
919 *pstatus
= smbXsrv_tcon_update(tcon
);
920 if (!NT_STATUS_IS_OK(*pstatus
)) {
928 /****************************************************************************
929 Make a connection to a service from SMB2. External SMB2 interface.
930 We must set cnum before claiming connection.
931 ****************************************************************************/
933 connection_struct
*make_connection_smb2(struct smbd_smb2_request
*req
,
934 struct smbXsrv_tcon
*tcon
,
936 struct user_struct
*vuser
,
940 struct smbd_server_connection
*sconn
= req
->sconn
;
941 connection_struct
*conn
= conn_new(sconn
);
943 DEBUG(0,("make_connection_smb2: Couldn't find free connection.\n"));
944 *pstatus
= NT_STATUS_INSUFFICIENT_RESOURCES
;
948 conn
->cnum
= tcon
->global
->tcon_wire_id
;
951 *pstatus
= make_connection_snum(req
->xconn
,
956 if (!NT_STATUS_IS_OK(*pstatus
)) {
963 /****************************************************************************
964 Make a connection to a service. External SMB1 interface.
967 ****************************************************************************/
969 connection_struct
*make_connection(struct smb_request
*req
,
971 const char *service_in
,
972 const char *pdev
, uint64_t vuid
,
975 struct smbd_server_connection
*sconn
= req
->sconn
;
977 struct user_struct
*vuser
= NULL
;
978 char *service
= NULL
;
984 /* This must ONLY BE CALLED AS ROOT. As it exits this function as
986 if (!non_root_mode() && (euid
= geteuid()) != 0) {
987 DEBUG(0,("make_connection: PANIC ERROR. Called as nonroot "
988 "(%u)\n", (unsigned int)euid
));
989 smb_panic("make_connection: PANIC ERROR. Called as nonroot\n");
992 if (conn_num_open(sconn
) > 2047) {
993 *status
= NT_STATUS_INSUFF_SERVER_RESOURCES
;
997 vuser
= get_valid_user_struct(sconn
, vuid
);
999 DEBUG(1,("make_connection: refusing to connect with "
1000 "no session setup\n"));
1001 *status
= NT_STATUS_ACCESS_DENIED
;
1005 /* Logic to try and connect to the correct [homes] share, preferably
1006 without too many getpwnam() lookups. This is particulary nasty for
1007 winbind usernames, where the share name isn't the same as unix
1010 The snum of the homes share is stored on the vuser at session setup
1014 if (strequal(service_in
,HOMES_NAME
)) {
1015 if (vuser
->homes_snum
== -1) {
1016 DEBUG(2, ("[homes] share not available for "
1017 "this user because it was not found "
1018 "or created at session setup "
1020 *status
= NT_STATUS_BAD_NETWORK_NAME
;
1023 DEBUG(5, ("making a connection to [homes] service "
1024 "created at session setup time\n"));
1025 return make_connection_smb1(req
, now
,
1029 } else if ((vuser
->homes_snum
!= -1)
1030 && strequal(service_in
,
1031 lp_servicename(talloc_tos(), vuser
->homes_snum
))) {
1032 DEBUG(5, ("making a connection to 'homes' service [%s] "
1033 "created at session setup time\n", service_in
));
1034 return make_connection_smb1(req
, now
,
1040 service
= talloc_strdup(talloc_tos(), service_in
);
1042 *status
= NT_STATUS_NO_MEMORY
;
1046 if (!strlower_m(service
)) {
1047 DEBUG(2, ("strlower_m %s failed\n", service
));
1048 *status
= NT_STATUS_INVALID_PARAMETER
;
1052 snum
= find_service(talloc_tos(), service
, &service
);
1054 *status
= NT_STATUS_NO_MEMORY
;
1059 if (strequal(service
,"IPC$") ||
1060 (lp_enable_asu_support() && strequal(service
,"ADMIN$"))) {
1061 DEBUG(3,("refusing IPC connection to %s\n", service
));
1062 *status
= NT_STATUS_ACCESS_DENIED
;
1066 DEBUG(3,("%s (%s) couldn't find service %s\n",
1067 get_remote_machine_name(),
1068 tsocket_address_string(
1069 sconn
->remote_address
, talloc_tos()),
1071 *status
= NT_STATUS_BAD_NETWORK_NAME
;
1075 /* Handle non-Dfs clients attempting connections to msdfs proxy */
1076 if (lp_host_msdfs() && (*lp_msdfs_proxy(talloc_tos(), snum
) != '\0')) {
1077 DEBUG(3, ("refusing connection to dfs proxy share '%s' "
1078 "(pointing to %s)\n",
1079 service
, lp_msdfs_proxy(talloc_tos(), snum
)));
1080 *status
= NT_STATUS_BAD_NETWORK_NAME
;
1084 DEBUG(5, ("making a connection to 'normal' service %s\n", service
));
1086 return make_connection_smb1(req
, now
, snum
, vuser
,
1090 /****************************************************************************
1092 ****************************************************************************/
1094 void close_cnum(connection_struct
*conn
, uint64_t vuid
)
1096 char rootpath
[2] = { '/', '\0'};
1097 struct smb_filename root_fname
= { .base_name
= rootpath
};
1099 file_close_conn(conn
);
1101 if (!IS_IPC(conn
)) {
1102 dptr_closecnum(conn
);
1105 change_to_root_user();
1107 DEBUG(IS_IPC(conn
)?3:2, ("%s (%s) closed connection to service %s\n",
1108 get_remote_machine_name(),
1109 tsocket_address_string(conn
->sconn
->remote_address
,
1111 lp_servicename(talloc_tos(), SNUM(conn
))));
1113 /* make sure we leave the directory available for unmount */
1114 vfs_ChDir(conn
, &root_fname
);
1116 /* Call VFS disconnect hook */
1117 SMB_VFS_DISCONNECT(conn
);
1119 /* execute any "postexec = " line */
1120 if (*lp_postexec(talloc_tos(), SNUM(conn
)) &&
1121 change_to_user(conn
, vuid
)) {
1122 char *cmd
= talloc_sub_advanced(talloc_tos(),
1123 lp_servicename(talloc_tos(), SNUM(conn
)),
1124 conn
->session_info
->unix_info
->unix_name
,
1126 conn
->session_info
->unix_token
->gid
,
1127 conn
->session_info
->unix_info
->sanitized_username
,
1128 conn
->session_info
->info
->domain_name
,
1129 lp_postexec(talloc_tos(), SNUM(conn
)));
1130 smbrun(cmd
, NULL
, NULL
);
1132 change_to_root_user();
1135 change_to_root_user();
1136 /* execute any "root postexec = " line */
1137 if (*lp_root_postexec(talloc_tos(), SNUM(conn
))) {
1138 char *cmd
= talloc_sub_advanced(talloc_tos(),
1139 lp_servicename(talloc_tos(), SNUM(conn
)),
1140 conn
->session_info
->unix_info
->unix_name
,
1142 conn
->session_info
->unix_token
->gid
,
1143 conn
->session_info
->unix_info
->sanitized_username
,
1144 conn
->session_info
->info
->domain_name
,
1145 lp_root_postexec(talloc_tos(), SNUM(conn
)));
1146 smbrun(cmd
, NULL
, NULL
);