?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Fix bug 8710 - connections.tdb - major leak with SMB2.
[Samba/gebeck_regimport.git] / source3 / smbd / service.c
blob4d55977ad2e32531672570c4cd47079fd719f2f5
1 /*
2 Unix SMB/CIFS implementation.
3 service (connection) opening and closing
4 Copyright (C) Andrew Tridgell 1992-1998
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
10
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
15
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
18 */
19
20 #include "includes.h"
21 #include "system/filesys.h"
22 #include "system/passwd.h" /* uid_wrapper */
23 #include "../lib/tsocket/tsocket.h"
24 #include "smbd/smbd.h"
25 #include "smbd/globals.h"
26 #include "../librpc/gen_ndr/netlogon.h"
27 #include "../libcli/security/security.h"
28 #include "printing/pcap.h"
29 #include "passdb/lookup_sid.h"
30 #include "auth.h"
31 #include "lib/param/loadparm.h"
32 #include "messages.h"
33
34 extern userdom_struct current_user_info;
35
36 static bool canonicalize_connect_path(connection_struct *conn)
37 {
38 bool ret;
39 char *resolved_name = SMB_VFS_REALPATH(conn,conn->connectpath);
40 if (!resolved_name) {
41 return false;
42 }
43 ret = set_conn_connectpath(conn,resolved_name);
44 SAFE_FREE(resolved_name);
45 return ret;
46 }
47
48 /****************************************************************************
49 Ensure when setting connectpath it is a canonicalized (no ./ // or ../)
50 absolute path stating in / and not ending in /.
51 Observent people will notice a similarity between this and check_path_syntax :-).
52 ****************************************************************************/
53
54 bool set_conn_connectpath(connection_struct *conn, const char *connectpath)
55 {
56 char *destname;
57 char *d;
58 const char *s = connectpath;
59 bool start_of_name_component = true;
60
61 if (connectpath == NULL || connectpath[0] == '\0') {
62 return false;
63 }
64
65 /* Allocate for strlen + '\0' + possible leading '/' */
66 destname = (char *)SMB_MALLOC(strlen(connectpath) + 2);
67 if (!destname) {
68 return false;
69 }
70 d = destname;
71
72 *d++ = '/'; /* Always start with root. */
73
74 while (*s) {
75 if (*s == '/') {
76 /* Eat multiple '/' */
77 while (*s == '/') {
78 s++;
79 }
80 if ((d > destname + 1) && (*s != '\0')) {
81 *d++ = '/';
82 }
83 start_of_name_component = True;
84 continue;
85 }
86
87 if (start_of_name_component) {
88 if ((s[0] == '.') && (s[1] == '.') && (s[2] == '/' || s[2] == '\0')) {
89 /* Uh oh - "/../" or "/..\0" ! */
90
91 /* Go past the ../ or .. */
92 if (s[2] == '/') {
93 s += 3;
94 } else {
95 s += 2; /* Go past the .. */
96 }
97
98 /* If we just added a '/' - delete it */
99 if ((d > destname) && (*(d-1) == '/')) {
100 *(d-1) = '\0';
101 d--;
102 }
103
104 /* Are we at the start ? Can't go back further if so. */
105 if (d <= destname) {
106 *d++ = '/'; /* Can't delete root */
107 continue;
108 }
109 /* Go back one level... */
110 /* Decrement d first as d points to the *next* char to write into. */
111 for (d--; d > destname; d--) {
112 if (*d == '/') {
113 break;
114 }
115 }
116 /* We're still at the start of a name component, just the previous one. */
117 continue;
118 } else if ((s[0] == '.') && ((s[1] == '\0') || s[1] == '/')) {
119 /* Component of pathname can't be "." only - skip the '.' . */
120 if (s[1] == '/') {
121 s += 2;
122 } else {
123 s++;
124 }
125 continue;
126 }
127 }
128
129 if (!(*s & 0x80)) {
130 *d++ = *s++;
131 } else {
132 size_t siz;
133 /* Get the size of the next MB character. */
134 next_codepoint(s,&siz);
135 switch(siz) {
136 case 5:
137 *d++ = *s++;
138 /*fall through*/
139 case 4:
140 *d++ = *s++;
141 /*fall through*/
142 case 3:
143 *d++ = *s++;
144 /*fall through*/
145 case 2:
146 *d++ = *s++;
147 /*fall through*/
148 case 1:
149 *d++ = *s++;
150 break;
151 default:
152 break;
153 }
154 }
155 start_of_name_component = false;
156 }
157 *d = '\0';
158
159 /* And must not end in '/' */
160 if (d > destname + 1 && (*(d-1) == '/')) {
161 *(d-1) = '\0';
162 }
163
164 DEBUG(10,("set_conn_connectpath: service %s, connectpath = %s\n",
165 lp_servicename(SNUM(conn)), destname ));
166
167 string_set(&conn->connectpath, destname);
168 SAFE_FREE(destname);
169 return true;
170 }
171
172 /****************************************************************************
173 Load parameters specific to a connection/service.
174 ****************************************************************************/
175
176 bool set_current_service(connection_struct *conn, uint16 flags, bool do_chdir)
177 {
178 int snum;
179
180 if (!conn) {
181 last_conn = NULL;
182 return(False);
183 }
184
185 conn->lastused_count++;
186
187 snum = SNUM(conn);
188
189 if (do_chdir &&
190 vfs_ChDir(conn,conn->connectpath) != 0 &&
191 vfs_ChDir(conn,conn->origpath) != 0) {
192 DEBUG(((errno!=EACCES)?0:3),("chdir (%s) failed, reason: %s\n",
193 conn->connectpath, strerror(errno)));
194 return(False);
195 }
196
197 if ((conn == last_conn) && (last_flags == flags)) {
198 return(True);
199 }
200
201 last_conn = conn;
202 last_flags = flags;
203
204 /* Obey the client case sensitivity requests - only for clients that support it. */
205 switch (lp_casesensitive(snum)) {
206 case Auto:
207 {
208 /* We need this uglyness due to DOS/Win9x clients that lie about case insensitivity. */
209 enum remote_arch_types ra_type = get_remote_arch();
210 if ((ra_type != RA_SAMBA) && (ra_type != RA_CIFSFS)) {
211 /* Client can't support per-packet case sensitive pathnames. */
212 conn->case_sensitive = False;
213 } else {
214 conn->case_sensitive = !(flags & FLAG_CASELESS_PATHNAMES);
215 }
216 }
217 break;
218 case True:
219 conn->case_sensitive = True;
220 break;
221 default:
222 conn->case_sensitive = False;
223 break;
224 }
225 return(True);
226 }
227
228 /****************************************************************************
229 do some basic sainity checks on the share.
230 This function modifies dev, ecode.
231 ****************************************************************************/
232
233 static NTSTATUS share_sanity_checks(const struct tsocket_address *remote_address,
234 const char *rhost,
235 int snum,
236 fstring dev)
237 {
238 char *raddr;
239
240 raddr = tsocket_address_inet_addr_string(remote_address,
241 talloc_tos());
242 if (raddr == NULL) {
243 return NT_STATUS_NO_MEMORY;
244 }
245
246 if (!lp_snum_ok(snum) ||
247 !allow_access(lp_hostsdeny(snum), lp_hostsallow(snum),
248 rhost, raddr)) {
249 return NT_STATUS_ACCESS_DENIED;
250 }
251
252 if (dev[0] == '?' || !dev[0]) {
253 if (lp_print_ok(snum)) {
254 fstrcpy(dev,"LPT1:");
255 } else if (strequal(lp_fstype(snum), "IPC")) {
256 fstrcpy(dev, "IPC");
257 } else {
258 fstrcpy(dev,"A:");
259 }
260 }
261
262 strupper_m(dev);
263
264 if (lp_print_ok(snum)) {
265 if (!strequal(dev, "LPT1:")) {
266 return NT_STATUS_BAD_DEVICE_TYPE;
267 }
268 } else if (strequal(lp_fstype(snum), "IPC")) {
269 if (!strequal(dev, "IPC")) {
270 return NT_STATUS_BAD_DEVICE_TYPE;
271 }
272 } else if (!strequal(dev, "A:")) {
273 return NT_STATUS_BAD_DEVICE_TYPE;
274 }
275
276 /* Behave as a printer if we are supposed to */
277 if (lp_print_ok(snum) && (strcmp(dev, "A:") == 0)) {
278 fstrcpy(dev, "LPT1:");
279 }
280
281 return NT_STATUS_OK;
282 }
283
284 /*
285 * Go through lookup_name etc to find the force'd group.
286 *
287 * Create a new token from src_token, replacing the primary group sid with the
288 * one found.
289 */
290
291 static NTSTATUS find_forced_group(bool force_user,
292 int snum, const char *username,
293 struct dom_sid *pgroup_sid,
294 gid_t *pgid)
295 {
296 NTSTATUS result = NT_STATUS_NO_SUCH_GROUP;
297 TALLOC_CTX *frame = talloc_stackframe();
298 struct dom_sid group_sid;
299 enum lsa_SidType type;
300 char *groupname;
301 bool user_must_be_member = False;
302 gid_t gid;
303
304 groupname = talloc_strdup(talloc_tos(), lp_force_group(snum));
305 if (groupname == NULL) {
306 DEBUG(1, ("talloc_strdup failed\n"));
307 result = NT_STATUS_NO_MEMORY;
308 goto done;
309 }
310
311 if (groupname[0] == '+') {
312 user_must_be_member = True;
313 groupname += 1;
314 }
315
316 groupname = talloc_string_sub(talloc_tos(), groupname,
317 "%S", lp_servicename(snum));
318 if (groupname == NULL) {
319 DEBUG(1, ("talloc_string_sub failed\n"));
320 result = NT_STATUS_NO_MEMORY;
321 goto done;
322 }
323
324 if (!lookup_name_smbconf(talloc_tos(), groupname,
325 LOOKUP_NAME_ALL|LOOKUP_NAME_GROUP,
326 NULL, NULL, &group_sid, &type)) {
327 DEBUG(10, ("lookup_name_smbconf(%s) failed\n",
328 groupname));
329 goto done;
330 }
331
332 if ((type != SID_NAME_DOM_GRP) && (type != SID_NAME_ALIAS) &&
333 (type != SID_NAME_WKN_GRP)) {
334 DEBUG(10, ("%s is a %s, not a group\n", groupname,
335 sid_type_lookup(type)));
336 goto done;
337 }
338
339 if (!sid_to_gid(&group_sid, &gid)) {
340 DEBUG(10, ("sid_to_gid(%s) for %s failed\n",
341 sid_string_dbg(&group_sid), groupname));
342 goto done;
343 }
344
345 /*
346 * If the user has been forced and the forced group starts with a '+',
347 * then we only set the group to be the forced group if the forced
348 * user is a member of that group. Otherwise, the meaning of the '+'
349 * would be ignored.
350 */
351
352 if (force_user && user_must_be_member) {
353 if (user_in_group_sid(username, &group_sid)) {
354 sid_copy(pgroup_sid, &group_sid);
355 *pgid = gid;
356 DEBUG(3,("Forced group %s for member %s\n",
357 groupname, username));
358 } else {
359 DEBUG(0,("find_forced_group: forced user %s is not a member "
360 "of forced group %s. Disallowing access.\n",
361 username, groupname ));
362 result = NT_STATUS_MEMBER_NOT_IN_GROUP;
363 goto done;
364 }
365 } else {
366 sid_copy(pgroup_sid, &group_sid);
367 *pgid = gid;
368 DEBUG(3,("Forced group %s\n", groupname));
369 }
370
371 result = NT_STATUS_OK;
372 done:
373 TALLOC_FREE(frame);
374 return result;
375 }
376
377 /****************************************************************************
378 Create an auth_session_info structure for a connection_struct
379 ****************************************************************************/
380
381 static NTSTATUS create_connection_session_info(struct smbd_server_connection *sconn,
382 TALLOC_CTX *mem_ctx, int snum,
383 struct auth_session_info *vuid_serverinfo,
384 DATA_BLOB password,
385 struct auth_session_info **presult)
386 {
387 if (lp_guest_only(snum)) {
388 return make_session_info_guest(mem_ctx, presult);
389 }
390
391 if (vuid_serverinfo != NULL) {
392
393 struct auth_session_info *result;
394
395 /*
396 * This is the normal security != share case where we have a
397 * valid vuid from the session setup. */
398
399 if (security_session_user_level(vuid_serverinfo, NULL) < SECURITY_USER) {
400 if (!lp_guest_ok(snum)) {
401 DEBUG(2, ("guest user (from session setup) "
402 "not permitted to access this share "
403 "(%s)\n", lp_servicename(snum)));
404 return NT_STATUS_ACCESS_DENIED;
405 }
406 } else {
407 if (!user_ok_token(vuid_serverinfo->unix_info->unix_name,
408 vuid_serverinfo->info->domain_name,
409 vuid_serverinfo->security_token, snum)) {
410 DEBUG(2, ("user '%s' (from session setup) not "
411 "permitted to access this share "
412 "(%s)\n",
413 vuid_serverinfo->unix_info->unix_name,
414 lp_servicename(snum)));
415 return NT_STATUS_ACCESS_DENIED;
416 }
417 }
418
419 result = copy_session_info(mem_ctx, vuid_serverinfo);
420 if (result == NULL) {
421 return NT_STATUS_NO_MEMORY;
422 }
423
424 *presult = result;
425 return NT_STATUS_OK;
426 }
427
428 if (lp_security() == SEC_SHARE) {
429
430 fstring user;
431 bool guest;
432
433 /* add the sharename as a possible user name if we
434 are in share mode security */
435
436 add_session_user(sconn, lp_servicename(snum));
437
438 /* shall we let them in? */
439
440 if (!authorise_login(sconn, snum,user,password,&guest)) {
441 DEBUG( 2, ( "Invalid username/password for [%s]\n",
442 lp_servicename(snum)) );
443 return NT_STATUS_WRONG_PASSWORD;
444 }
445
446 return make_session_info_from_username(mem_ctx, user, guest,
447 presult);
448 }
449
450 DEBUG(0, ("invalid VUID (vuser) but not in security=share\n"));
451 return NT_STATUS_ACCESS_DENIED;
452 }
453
454 /****************************************************************************
455 set relavent user and group settings corresponding to force user/group
456 configuration for the given snum.
457 ****************************************************************************/
458
459 NTSTATUS set_conn_force_user_group(connection_struct *conn, int snum)
460 {
461 NTSTATUS status;
462
463 if (*lp_force_user(snum)) {
464
465 /*
466 * Replace conn->session_info with a completely faked up one
467 * from the username we are forced into :-)
468 */
469
470 char *fuser;
471 struct auth_session_info *forced_serverinfo;
472 bool guest;
473
474 fuser = talloc_string_sub(conn, lp_force_user(snum), "%S",
475 lp_const_servicename(snum));
476 if (fuser == NULL) {
477 return NT_STATUS_NO_MEMORY;
478 }
479
480 guest = security_session_user_level(conn->session_info, NULL) < SECURITY_USER;
481
482 status = make_session_info_from_username(
483 conn, fuser,
484 guest,
485 &forced_serverinfo);
486 if (!NT_STATUS_IS_OK(status)) {
487 return status;
488 }
489
490 TALLOC_FREE(conn->session_info);
491 conn->session_info = forced_serverinfo;
492
493 conn->force_user = true;
494 DEBUG(3,("Forced user %s\n", fuser));
495 }
496
497 /*
498 * If force group is true, then override
499 * any groupid stored for the connecting user.
500 */
501
502 if (*lp_force_group(snum)) {
503
504 status = find_forced_group(
505 conn->force_user, snum, conn->session_info->unix_info->unix_name,
506 &conn->session_info->security_token->sids[1],
507 &conn->session_info->unix_token->gid);
508
509 if (!NT_STATUS_IS_OK(status)) {
510 return status;
511 }
512
513 /*
514 * We need to cache this gid, to use within
515 * change_to_user() separately from the conn->session_info
516 * struct. We only use conn->session_info directly if
517 * "force_user" was set.
518 */
519 conn->force_group_gid = conn->session_info->unix_token->gid;
520 }
521
522 return NT_STATUS_OK;
523 }
524
525 /****************************************************************************
526 Make a connection, given the snum to connect to, and the vuser of the
527 connecting user if appropriate.
528 ****************************************************************************/
529
530 static connection_struct *make_connection_snum(struct smbd_server_connection *sconn,
531 connection_struct *conn,
532 int snum, user_struct *vuser,
533 DATA_BLOB password,
534 const char *pdev,
535 NTSTATUS *pstatus)
536 {
537 struct smb_filename *smb_fname_cpath = NULL;
538 fstring dev;
539 int ret;
540 bool on_err_call_dis_hook = false;
541 bool claimed_connection = false;
542 uid_t effuid;
543 gid_t effgid;
544 NTSTATUS status;
545
546 fstrcpy(dev, pdev);
547
548 *pstatus = share_sanity_checks(sconn->remote_address,
549 sconn->remote_hostname,
550 snum,
551 dev);
552 if (NT_STATUS_IS_ERR(*pstatus)) {
553 goto err_root_exit;
554 }
555
556 conn->params->service = snum;
557
558 status = create_connection_session_info(sconn,
559 conn, snum, vuser ? vuser->session_info : NULL, password,
560 &conn->session_info);
561
562 if (!NT_STATUS_IS_OK(status)) {
563 DEBUG(1, ("create_connection_session_info failed: %s\n",
564 nt_errstr(status)));
565 *pstatus = status;
566 goto err_root_exit;
567 }
568
569 if ((lp_guest_only(snum)) || (lp_security() == SEC_SHARE)) {
570 conn->force_user = true;
571 }
572
573 add_session_user(sconn, conn->session_info->unix_info->unix_name);
574
575 conn->num_files_open = 0;
576 conn->lastused = conn->lastused_count = time(NULL);
577 conn->used = True;
578 conn->printer = (strncmp(dev,"LPT",3) == 0);
579 conn->ipc = ( (strncmp(dev,"IPC",3) == 0) ||
580 ( lp_enable_asu_support() && strequal(dev,"ADMIN$")) );
581
582 /* Case options for the share. */
583 if (lp_casesensitive(snum) == Auto) {
584 /* We will be setting this per packet. Set to be case
585 * insensitive for now. */
586 conn->case_sensitive = False;
587 } else {
588 conn->case_sensitive = (bool)lp_casesensitive(snum);
589 }
590
591 conn->case_preserve = lp_preservecase(snum);
592 conn->short_case_preserve = lp_shortpreservecase(snum);
593
594 conn->encrypt_level = lp_smb_encrypt(snum);
595
596 conn->veto_list = NULL;
597 conn->hide_list = NULL;
598 conn->veto_oplock_list = NULL;
599 conn->aio_write_behind_list = NULL;
600
601 conn->read_only = lp_readonly(SNUM(conn));
602
603 status = set_conn_force_user_group(conn, snum);
604 if (!NT_STATUS_IS_OK(status)) {
605 *pstatus = status;
606 return NULL;
607 }
608
609 conn->vuid = (vuser != NULL) ? vuser->vuid : UID_FIELD_INVALID;
610
611 {
612 char *s = talloc_sub_advanced(talloc_tos(),
613 lp_servicename(SNUM(conn)),
614 conn->session_info->unix_info->unix_name,
615 conn->connectpath,
616 conn->session_info->unix_token->gid,
617 conn->session_info->unix_info->sanitized_username,
618 conn->session_info->info->domain_name,
619 lp_pathname(snum));
620 if (!s) {
621 *pstatus = NT_STATUS_NO_MEMORY;
622 goto err_root_exit;
623 }
624
625 if (!set_conn_connectpath(conn,s)) {
626 TALLOC_FREE(s);
627 *pstatus = NT_STATUS_NO_MEMORY;
628 goto err_root_exit;
629 }
630 DEBUG(3,("Connect path is '%s' for service [%s]\n",s,
631 lp_servicename(snum)));
632 TALLOC_FREE(s);
633 }
634
635 /*
636 * New code to check if there's a share security descripter
637 * added from NT server manager. This is done after the
638 * smb.conf checks are done as we need a uid and token. JRA.
639 *
640 */
641
642 share_access_check(conn->session_info->security_token,
643 lp_servicename(snum), MAXIMUM_ALLOWED_ACCESS,
644 &conn->share_access);
645
646 if ((conn->share_access & FILE_WRITE_DATA) == 0) {
647 if ((conn->share_access & FILE_READ_DATA) == 0) {
648 /* No access, read or write. */
649 DEBUG(0,("make_connection: connection to %s "
650 "denied due to security "
651 "descriptor.\n",
652 lp_servicename(snum)));
653 *pstatus = NT_STATUS_ACCESS_DENIED;
654 goto err_root_exit;
655 } else {
656 conn->read_only = True;
657 }
658 }
659 /* Initialise VFS function pointers */
660
661 if (!smbd_vfs_init(conn)) {
662 DEBUG(0, ("vfs_init failed for service %s\n",
663 lp_servicename(snum)));
664 *pstatus = NT_STATUS_BAD_NETWORK_NAME;
665 goto err_root_exit;
666 }
667
668 /* ROOT Activities: */
669 /* explicitly check widelinks here so that we can correctly warn
670 * in the logs. */
671 widelinks_warning(snum);
672
673 /*
674 * Enforce the max connections parameter.
675 */
676
677 if ((lp_max_connections(snum) > 0)
678 && (count_current_connections(lp_servicename(SNUM(conn)), True) >=
679 lp_max_connections(snum))) {
680
681 DEBUG(1, ("Max connections (%d) exceeded for %s\n",
682 lp_max_connections(snum), lp_servicename(snum)));
683 *pstatus = NT_STATUS_INSUFFICIENT_RESOURCES;
684 goto err_root_exit;
685 }
686
687 /*
688 * Get us an entry in the connections db
689 */
690 if (!claim_connection(conn, lp_servicename(snum))) {
691 DEBUG(1, ("Could not store connections entry\n"));
692 *pstatus = NT_STATUS_INTERNAL_DB_ERROR;
693 goto err_root_exit;
694 }
695 claimed_connection = true;
696
697 /* Invoke VFS make connection hook - this must be the first
698 filesystem operation that we do. */
699
700 if (SMB_VFS_CONNECT(conn, lp_servicename(snum),
701 conn->session_info->unix_info->unix_name) < 0) {
702 DEBUG(0,("make_connection: VFS make connection failed!\n"));
703 *pstatus = NT_STATUS_UNSUCCESSFUL;
704 goto err_root_exit;
705 }
706
707 /* Any error exit after here needs to call the disconnect hook. */
708 on_err_call_dis_hook = true;
709
710 if ((!conn->printer) && (!conn->ipc)) {
711 conn->notify_ctx = notify_init(conn,
712 messaging_server_id(sconn->msg_ctx),
713 sconn->msg_ctx,
714 sconn->ev_ctx,
715 conn);
716 }
717
718 /*
719 * Fix compatibility issue pointed out by Volker.
720 * We pass the conn->connectpath to the preexec
721 * scripts as a parameter, so attempt to canonicalize
722 * it here before calling the preexec scripts.
723 * We ignore errors here, as it is possible that
724 * the conn->connectpath doesn't exist yet and
725 * the preexec scripts will create them.
726 */
727
728 (void)canonicalize_connect_path(conn);
729
730 /* Preexecs are done here as they might make the dir we are to ChDir
731 * to below */
732 /* execute any "root preexec = " line */
733 if (*lp_rootpreexec(snum)) {
734 char *cmd = talloc_sub_advanced(talloc_tos(),
735 lp_servicename(SNUM(conn)),
736 conn->session_info->unix_info->unix_name,
737 conn->connectpath,
738 conn->session_info->unix_token->gid,
739 conn->session_info->unix_info->sanitized_username,
740 conn->session_info->info->domain_name,
741 lp_rootpreexec(snum));
742 DEBUG(5,("cmd=%s\n",cmd));
743 ret = smbrun(cmd,NULL);
744 TALLOC_FREE(cmd);
745 if (ret != 0 && lp_rootpreexec_close(snum)) {
746 DEBUG(1,("root preexec gave %d - failing "
747 "connection\n", ret));
748 *pstatus = NT_STATUS_ACCESS_DENIED;
749 goto err_root_exit;
750 }
751 }
752
753 /* USER Activites: */
754 if (!change_to_user(conn, conn->vuid)) {
755 /* No point continuing if they fail the basic checks */
756 DEBUG(0,("Can't become connected user!\n"));
757 *pstatus = NT_STATUS_LOGON_FAILURE;
758 goto err_root_exit;
759 }
760
761 effuid = geteuid();
762 effgid = getegid();
763
764 /* Remember that a different vuid can connect later without these
765 * checks... */
766
767 /* Preexecs are done here as they might make the dir we are to ChDir
768 * to below */
769
770 /* execute any "preexec = " line */
771 if (*lp_preexec(snum)) {
772 char *cmd = talloc_sub_advanced(talloc_tos(),
773 lp_servicename(SNUM(conn)),
774 conn->session_info->unix_info->unix_name,
775 conn->connectpath,
776 conn->session_info->unix_token->gid,
777 conn->session_info->unix_info->sanitized_username,
778 conn->session_info->info->domain_name,
779 lp_preexec(snum));
780 ret = smbrun(cmd,NULL);
781 TALLOC_FREE(cmd);
782 if (ret != 0 && lp_preexec_close(snum)) {
783 DEBUG(1,("preexec gave %d - failing connection\n",
784 ret));
785 *pstatus = NT_STATUS_ACCESS_DENIED;
786 goto err_root_exit;
787 }
788 }
789
790 #ifdef WITH_FAKE_KASERVER
791 if (lp_afs_share(snum)) {
792 afs_login(conn);
793 }
794 #endif
795
796 /*
797 * we've finished with the user stuff - go back to root
798 * so the SMB_VFS_STAT call will only fail on path errors,
799 * not permission problems.
800 */
801 change_to_root_user();
802 /* ROOT Activites: */
803
804 /*
805 * If widelinks are disallowed we need to canonicalise the connect
806 * path here to ensure we don't have any symlinks in the
807 * connectpath. We will be checking all paths on this connection are
808 * below this directory. We must do this after the VFS init as we
809 * depend on the realpath() pointer in the vfs table. JRA.
810 */
811 if (!lp_widelinks(snum)) {
812 if (!canonicalize_connect_path(conn)) {
813 DEBUG(0, ("canonicalize_connect_path failed "
814 "for service %s, path %s\n",
815 lp_servicename(snum),
816 conn->connectpath));
817 *pstatus = NT_STATUS_BAD_NETWORK_NAME;
818 goto err_root_exit;
819 }
820 }
821
822 /* Add veto/hide lists */
823 if (!IS_IPC(conn) && !IS_PRINT(conn)) {
824 set_namearray( &conn->veto_list, lp_veto_files(snum));
825 set_namearray( &conn->hide_list, lp_hide_files(snum));
826 set_namearray( &conn->veto_oplock_list, lp_veto_oplocks(snum));
827 set_namearray( &conn->aio_write_behind_list,
828 lp_aio_write_behind(snum));
829 }
830 status = create_synthetic_smb_fname(talloc_tos(), conn->connectpath,
831 NULL, NULL, &smb_fname_cpath);
832 if (!NT_STATUS_IS_OK(status)) {
833 *pstatus = status;
834 goto err_root_exit;
835 }
836
837 /* win2000 does not check the permissions on the directory
838 during the tree connect, instead relying on permission
839 check during individual operations. To match this behaviour
840 I have disabled this chdir check (tridge) */
841 /* the alternative is just to check the directory exists */
842
843 if ((ret = SMB_VFS_STAT(conn, smb_fname_cpath)) != 0 ||
844 !S_ISDIR(smb_fname_cpath->st.st_ex_mode)) {
845 if (ret == 0 && !S_ISDIR(smb_fname_cpath->st.st_ex_mode)) {
846 DEBUG(0,("'%s' is not a directory, when connecting to "
847 "[%s]\n", conn->connectpath,
848 lp_servicename(snum)));
849 } else {
850 DEBUG(0,("'%s' does not exist or permission denied "
851 "when connecting to [%s] Error was %s\n",
852 conn->connectpath, lp_servicename(snum),
853 strerror(errno) ));
854 }
855 *pstatus = NT_STATUS_BAD_NETWORK_NAME;
856 goto err_root_exit;
857 }
858 conn->base_share_dev = smb_fname_cpath->st.st_ex_dev;
859
860 string_set(&conn->origpath,conn->connectpath);
861
862 /* Figure out the characteristics of the underlying filesystem. This
863 * assumes that all the filesystem mounted withing a share path have
864 * the same characteristics, which is likely but not guaranteed.
865 */
866
867 conn->fs_capabilities = SMB_VFS_FS_CAPABILITIES(conn, &conn->ts_res);
868
869 /*
870 * Print out the 'connected as' stuff here as we need
871 * to know the effective uid and gid we will be using
872 * (at least initially).
873 */
874
875 if( DEBUGLVL( IS_IPC(conn) ? 3 : 1 ) ) {
876 dbgtext( "%s (%s) ", get_remote_machine_name(),
877 tsocket_address_string(conn->sconn->remote_address,
878 talloc_tos()) );
879 dbgtext( "%s", srv_is_signing_active(sconn) ? "signed " : "");
880 dbgtext( "connect to service %s ", lp_servicename(snum) );
881 dbgtext( "initially as user %s ",
882 conn->session_info->unix_info->unix_name );
883 dbgtext( "(uid=%d, gid=%d) ", (int)effuid, (int)effgid );
884 dbgtext( "(pid %d)\n", (int)sys_getpid() );
885 }
886
887 return(conn);
888
889 err_root_exit:
890 TALLOC_FREE(smb_fname_cpath);
891 /* We must exit this function as root. */
892 if (geteuid() != 0) {
893 change_to_root_user();
894 }
895 if (on_err_call_dis_hook) {
896 /* Call VFS disconnect hook */
897 SMB_VFS_DISCONNECT(conn);
898 }
899 if (claimed_connection) {
900 yield_connection(conn, lp_servicename(snum));
901 }
902 return NULL;
903 }
904
905 /****************************************************************************
906 Make a connection to a service from SMB1. Internal interface.
907 ****************************************************************************/
908
909 static connection_struct *make_connection_smb1(struct smbd_server_connection *sconn,
910 int snum, user_struct *vuser,
911 DATA_BLOB password,
912 const char *pdev,
913 NTSTATUS *pstatus)
914 {
915 connection_struct *ret_conn = NULL;
916 connection_struct *conn = conn_new(sconn);
917 if (!conn) {
918 DEBUG(0,("make_connection_smb1: Couldn't find free connection.\n"));
919 *pstatus = NT_STATUS_INSUFFICIENT_RESOURCES;
920 return NULL;
921 }
922 ret_conn = make_connection_snum(sconn,
923 conn,
924 snum,
925 vuser,
926 password,
927 pdev,
928 pstatus);
929 if (ret_conn != conn) {
930 conn_free(conn);
931 return NULL;
932 }
933 return conn;
934 }
935
936 /****************************************************************************
937 Make a connection to a service from SMB2. External SMB2 interface.
938 We must set cnum before claiming connection.
939 ****************************************************************************/
940
941 connection_struct *make_connection_smb2(struct smbd_server_connection *sconn,
942 struct smbd_smb2_tcon *tcon,
943 user_struct *vuser,
944 DATA_BLOB password,
945 const char *pdev,
946 NTSTATUS *pstatus)
947 {
948 connection_struct *ret_conn = NULL;
949 connection_struct *conn = conn_new(sconn);
950 if (!conn) {
951 DEBUG(0,("make_connection_smb2: Couldn't find free connection.\n"));
952 *pstatus = NT_STATUS_INSUFFICIENT_RESOURCES;
953 return NULL;
954 }
955 conn->cnum = tcon->tid;
956 ret_conn = make_connection_snum(sconn,
957 conn,
958 tcon->snum,
959 vuser,
960 password,
961 pdev,
962 pstatus);
963 if (ret_conn != conn) {
964 conn_free(conn);
965 return NULL;
966 }
967 return conn;
968 }
969
970 /****************************************************************************
971 Make a connection to a service. External SMB1 interface.
972 *
973 * @param service
974 ****************************************************************************/
975
976 connection_struct *make_connection(struct smbd_server_connection *sconn,
977 const char *service_in, DATA_BLOB password,
978 const char *pdev, uint16 vuid,
979 NTSTATUS *status)
980 {
981 uid_t euid;
982 user_struct *vuser = NULL;
983 char *service = NULL;
984 fstring dev;
985 int snum = -1;
986
987 fstrcpy(dev, pdev);
988
989 /* This must ONLY BE CALLED AS ROOT. As it exits this function as
990 * root. */
991 if (!non_root_mode() && (euid = geteuid()) != 0) {
992 DEBUG(0,("make_connection: PANIC ERROR. Called as nonroot "
993 "(%u)\n", (unsigned int)euid ));
994 smb_panic("make_connection: PANIC ERROR. Called as nonroot\n");
995 }
996
997 if (conn_num_open(sconn) > 2047) {
998 *status = NT_STATUS_INSUFF_SERVER_RESOURCES;
999 return NULL;
1000 }
1001
1002 if(lp_security() != SEC_SHARE) {
1003 vuser = get_valid_user_struct(sconn, vuid);
1004 if (!vuser) {
1005 DEBUG(1,("make_connection: refusing to connect with "
1006 "no session setup\n"));
1007 *status = NT_STATUS_ACCESS_DENIED;
1008 return NULL;
1009 }
1010 }
1011
1012 /* Logic to try and connect to the correct [homes] share, preferably
1013 without too many getpwnam() lookups. This is particulary nasty for
1014 winbind usernames, where the share name isn't the same as unix
1015 username.
1016
1017 The snum of the homes share is stored on the vuser at session setup
1018 time.
1019 */
1020
1021 if (strequal(service_in,HOMES_NAME)) {
1022 if(lp_security() != SEC_SHARE) {
1023 DATA_BLOB no_pw = data_blob_null;
1024 if (vuser->homes_snum == -1) {
1025 DEBUG(2, ("[homes] share not available for "
1026 "this user because it was not found "
1027 "or created at session setup "
1028 "time\n"));
1029 *status = NT_STATUS_BAD_NETWORK_NAME;
1030 return NULL;
1031 }
1032 DEBUG(5, ("making a connection to [homes] service "
1033 "created at session setup time\n"));
1034 return make_connection_smb1(sconn,
1035 vuser->homes_snum,
1036 vuser, no_pw,
1037 dev, status);
1038 } else {
1039 /* Security = share. Try with
1040 * current_user_info.smb_name as the username. */
1041 if (*current_user_info.smb_name) {
1042 char *unix_username = NULL;
1043 (void)map_username(talloc_tos(),
1044 current_user_info.smb_name,
1045 &unix_username);
1046 snum = find_service(talloc_tos(),
1047 unix_username,
1048 &unix_username);
1049 if (!unix_username) {
1050 *status = NT_STATUS_NO_MEMORY;
1051 }
1052 return NULL;
1053 }
1054 if (snum != -1) {
1055 DEBUG(5, ("making a connection to 'homes' "
1056 "service %s based on "
1057 "security=share\n", service_in));
1058 return make_connection_smb1(sconn,
1059 snum, NULL,
1060 password,
1061 dev, status);
1062 }
1063 }
1064 } else if ((lp_security() != SEC_SHARE) && (vuser->homes_snum != -1)
1065 && strequal(service_in,
1066 lp_servicename(vuser->homes_snum))) {
1067 DATA_BLOB no_pw = data_blob_null;
1068 DEBUG(5, ("making a connection to 'homes' service [%s] "
1069 "created at session setup time\n", service_in));
1070 return make_connection_smb1(sconn,
1071 vuser->homes_snum,
1072 vuser, no_pw,
1073 dev, status);
1074 }
1075
1076 service = talloc_strdup(talloc_tos(), service_in);
1077 if (!service) {
1078 *status = NT_STATUS_NO_MEMORY;
1079 return NULL;
1080 }
1081
1082 strlower_m(service);
1083
1084 snum = find_service(talloc_tos(), service, &service);
1085 if (!service) {
1086 *status = NT_STATUS_NO_MEMORY;
1087 return NULL;
1088 }
1089
1090 if (snum < 0) {
1091 if (strequal(service,"IPC$") ||
1092 (lp_enable_asu_support() && strequal(service,"ADMIN$"))) {
1093 DEBUG(3,("refusing IPC connection to %s\n", service));
1094 *status = NT_STATUS_ACCESS_DENIED;
1095 return NULL;
1096 }
1097
1098 DEBUG(3,("%s (%s) couldn't find service %s\n",
1099 get_remote_machine_name(),
1100 tsocket_address_string(
1101 sconn->remote_address, talloc_tos()),
1102 service));
1103 *status = NT_STATUS_BAD_NETWORK_NAME;
1104 return NULL;
1105 }
1106
1107 /* Handle non-Dfs clients attempting connections to msdfs proxy */
1108 if (lp_host_msdfs() && (*lp_msdfs_proxy(snum) != '\0')) {
1109 DEBUG(3, ("refusing connection to dfs proxy share '%s' "
1110 "(pointing to %s)\n",
1111 service, lp_msdfs_proxy(snum)));
1112 *status = NT_STATUS_BAD_NETWORK_NAME;
1113 return NULL;
1114 }
1115
1116 DEBUG(5, ("making a connection to 'normal' service %s\n", service));
1117
1118 return make_connection_smb1(sconn, snum, vuser,
1119 password,
1120 dev, status);
1121 }
1122
1123 /****************************************************************************
1124 Close a cnum.
1125 ****************************************************************************/
1126
1127 void close_cnum(connection_struct *conn, uint16 vuid)
1128 {
1129 file_close_conn(conn);
1130
1131 if (!IS_IPC(conn)) {
1132 dptr_closecnum(conn);
1133 }
1134
1135 change_to_root_user();
1136
1137 DEBUG(IS_IPC(conn)?3:1, ("%s (%s) closed connection to service %s\n",
1138 get_remote_machine_name(),
1139 tsocket_address_string(conn->sconn->remote_address,
1140 talloc_tos()),
1141 lp_servicename(SNUM(conn))));
1142
1143 /* Call VFS disconnect hook */
1144 SMB_VFS_DISCONNECT(conn);
1145
1146 yield_connection(conn, lp_servicename(SNUM(conn)));
1147
1148 /* make sure we leave the directory available for unmount */
1149 vfs_ChDir(conn, "/");
1150
1151 /* execute any "postexec = " line */
1152 if (*lp_postexec(SNUM(conn)) &&
1153 change_to_user(conn, vuid)) {
1154 char *cmd = talloc_sub_advanced(talloc_tos(),
1155 lp_servicename(SNUM(conn)),
1156 conn->session_info->unix_info->unix_name,
1157 conn->connectpath,
1158 conn->session_info->unix_token->gid,
1159 conn->session_info->unix_info->sanitized_username,
1160 conn->session_info->info->domain_name,
1161 lp_postexec(SNUM(conn)));
1162 smbrun(cmd,NULL);
1163 TALLOC_FREE(cmd);
1164 change_to_root_user();
1165 }
1166
1167 change_to_root_user();
1168 /* execute any "root postexec = " line */
1169 if (*lp_rootpostexec(SNUM(conn))) {
1170 char *cmd = talloc_sub_advanced(talloc_tos(),
1171 lp_servicename(SNUM(conn)),
1172 conn->session_info->unix_info->unix_name,
1173 conn->connectpath,
1174 conn->session_info->unix_token->gid,
1175 conn->session_info->unix_info->sanitized_username,
1176 conn->session_info->info->domain_name,
1177 lp_rootpostexec(SNUM(conn)));
1178 smbrun(cmd,NULL);
1179 TALLOC_FREE(cmd);
1180 }
1181
1182 conn_free(conn);
1183 }
reg import