Unix SMB/CIFS implementation.
service (connection) opening and closing
Copyright (C) Andrew Tridgell 1992-1998
-
+
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
-
+
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
-
+
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
+#include "system/filesys.h"
+#include "smbd/smbd.h"
#include "smbd/globals.h"
+#include "../librpc/gen_ndr/netlogon.h"
+#include "../libcli/security/security.h"
+#include "printing/pcap.h"
+#include "passdb/lookup_sid.h"
extern userdom_struct current_user_info;
static bool canonicalize_connect_path(connection_struct *conn)
{
-#ifdef REALPATH_TAKES_NULL
bool ret;
- char *resolved_name = SMB_VFS_REALPATH(conn,conn->connectpath,NULL);
+ char *resolved_name = SMB_VFS_REALPATH(conn,conn->connectpath);
if (!resolved_name) {
return false;
}
ret = set_conn_connectpath(conn,resolved_name);
SAFE_FREE(resolved_name);
return ret;
-#else
- char resolved_name_buf[PATH_MAX+1];
- char *resolved_name = SMB_VFS_REALPATH(conn,conn->connectpath,resolved_name_buf);
- if (!resolved_name) {
- return false;
- }
- return set_conn_connectpath(conn,resolved_name);
-#endif /* REALPATH_TAKES_NULL */
}
/****************************************************************************
}
/* Allocate for strlen + '\0' + possible leading '/' */
- destname = SMB_MALLOC(strlen(connectpath) + 2);
+ destname = (char *)SMB_MALLOC(strlen(connectpath) + 2);
if (!destname) {
return false;
}
conn->lastused_count++;
snum = SNUM(conn);
-
+
if (do_chdir &&
vfs_ChDir(conn,conn->connectpath) != 0 &&
vfs_ChDir(conn,conn->origpath) != 0) {
last_conn = conn;
last_flags = flags;
-
+
/* Obey the client case sensitivity requests - only for clients that support it. */
switch (lp_casesensitive(snum)) {
case Auto:
if (!lp_add_home(service, iHomeService, username, homedir)) {
return -1;
}
-
+
return lp_servicenumber(service);
}
* @param service is modified (to canonical form??)
**/
-int find_service(fstring service)
+int find_service(TALLOC_CTX *ctx, const char *service_in, char **p_service_out)
{
int iService;
- struct smbd_server_connection *sconn = smbd_server_conn;
- all_string_sub(service,"\\","/",0);
+ if (!service_in) {
+ return -1;
+ }
+
+ /* First make a copy. */
+ *p_service_out = talloc_strdup(ctx, service_in);
+ if (!*p_service_out) {
+ return -1;
+ }
+
+ all_string_sub(*p_service_out,"\\","/",0);
- iService = lp_servicenumber(service);
+ iService = lp_servicenumber(*p_service_out);
/* now handle the special case of a home directory */
if (iService < 0) {
- char *phome_dir = get_user_home_dir(talloc_tos(), service);
+ char *phome_dir = get_user_home_dir(ctx, *p_service_out);
if(!phome_dir) {
/*
* Try mapping the servicename, it may
* be a Windows to unix mapped user name.
*/
- if(map_username(sconn, service))
+ if(map_username(ctx, *p_service_out, p_service_out)) {
+ if (*p_service_out == NULL) {
+ /* Out of memory. */
+ return -1;
+ }
phome_dir = get_user_home_dir(
- talloc_tos(), service);
+ ctx, *p_service_out);
+ }
}
- DEBUG(3,("checking for home directory %s gave %s\n",service,
+ DEBUG(3,("checking for home directory %s gave %s\n",*p_service_out,
phome_dir?phome_dir:"(NULL)"));
- iService = add_home_service(service,service /* 'username' */, phome_dir);
+ iService = add_home_service(*p_service_out,*p_service_out /* 'username' */, phome_dir);
}
/* If we still don't have a service, attempt to add it as a printer. */
if ((iPrinterService = lp_servicenumber(PRINTERS_NAME)) < 0) {
iPrinterService = load_registry_service(PRINTERS_NAME);
}
- if (iPrinterService) {
- DEBUG(3,("checking whether %s is a valid printer name...\n", service));
- if (pcap_printername_ok(service)) {
- DEBUG(3,("%s is a valid printer name\n", service));
- DEBUG(3,("adding %s as a printer service\n", service));
- lp_add_printer(service, iPrinterService);
- iService = lp_servicenumber(service);
+ if (iPrinterService >= 0) {
+ DEBUG(3,("checking whether %s is a valid printer name...\n",
+ *p_service_out));
+ if (pcap_printername_ok(*p_service_out)) {
+ DEBUG(3,("%s is a valid printer name\n",
+ *p_service_out));
+ DEBUG(3,("adding %s as a printer service\n",
+ *p_service_out));
+ lp_add_printer(*p_service_out, iPrinterService);
+ iService = lp_servicenumber(*p_service_out);
if (iService < 0) {
- DEBUG(0,("failed to add %s as a printer service!\n", service));
+ DEBUG(0,("failed to add %s as a printer service!\n",
+ *p_service_out));
}
} else {
- DEBUG(3,("%s is not a valid printer name\n", service));
+ DEBUG(3,("%s is not a valid printer name\n",
+ *p_service_out));
}
}
}
}
if (iService < 0) {
- iService = load_registry_service(service);
+ iService = load_registry_service(*p_service_out);
}
/* Is it a usershare service ? */
if (iService < 0 && *lp_usershare_path()) {
/* Ensure the name is canonicalized. */
- strlower_m(service);
- iService = load_usershare_service(service);
+ strlower_m(*p_service_out);
+ iService = load_usershare_service(*p_service_out);
}
/* just possibly it's a default service? */
if (iService < 0) {
char *pdefservice = lp_defaultservice();
- if (pdefservice && *pdefservice && !strequal(pdefservice,service) && !strstr_m(service,"..")) {
+ if (pdefservice &&
+ *pdefservice &&
+ !strequal(pdefservice, *p_service_out)
+ && !strstr_m(*p_service_out,"..")) {
/*
* We need to do a local copy here as lp_defaultservice()
* returns one of the rotating lp_string buffers that
* could get overwritten by the recursive find_service() call
* below. Fix from Josef Hinteregger <joehtg@joehtg.co.at>.
*/
- char *defservice = SMB_STRDUP(pdefservice);
+ char *defservice = talloc_strdup(ctx, pdefservice);
if (!defservice) {
goto fail;
if (strequal(defservice,HOMES_NAME) ||
strequal(defservice, PRINTERS_NAME) ||
strequal(defservice, "IPC$")) {
- SAFE_FREE(defservice);
+ TALLOC_FREE(defservice);
goto fail;
}
- iService = find_service(defservice);
+ iService = find_service(ctx, defservice, p_service_out);
+ if (!*p_service_out) {
+ TALLOC_FREE(defservice);
+ iService = -1;
+ goto fail;
+ }
if (iService >= 0) {
- all_string_sub(service, "_","/",0);
- iService = lp_add_service(service, iService);
+ all_string_sub(*p_service_out, "_","/",0);
+ iService = lp_add_service(*p_service_out, iService);
}
- SAFE_FREE(defservice);
+ TALLOC_FREE(defservice);
}
}
if (iService >= 0) {
if (!VALID_SNUM(iService)) {
- DEBUG(0,("Invalid snum %d for %s\n",iService, service));
+ DEBUG(0,("Invalid snum %d for %s\n",iService,
+ *p_service_out));
iService = -1;
}
}
fail:
- if (iService < 0)
- DEBUG(3,("find_service() failed to find service %s\n", service));
+ if (iService < 0) {
+ DEBUG(3,("find_service() failed to find service %s\n",
+ *p_service_out));
+ }
return (iService);
}
This function modifies dev, ecode.
****************************************************************************/
-static NTSTATUS share_sanity_checks(int snum, fstring dev)
+static NTSTATUS share_sanity_checks(struct client_address *client_id, int snum,
+ fstring dev)
{
-
if (!lp_snum_ok(snum) ||
- !check_access(smbd_server_fd(),
- lp_hostsallow(snum), lp_hostsdeny(snum))) {
+ !allow_access(lp_hostsdeny(snum), lp_hostsallow(snum),
+ client_id->name, client_id->addr)) {
return NT_STATUS_ACCESS_DENIED;
}
static NTSTATUS find_forced_group(bool force_user,
int snum, const char *username,
- DOM_SID *pgroup_sid,
+ struct dom_sid *pgroup_sid,
gid_t *pgid)
{
NTSTATUS result = NT_STATUS_NO_SUCH_GROUP;
TALLOC_CTX *frame = talloc_stackframe();
- DOM_SID group_sid;
+ struct dom_sid group_sid;
enum lsa_SidType type;
char *groupname;
bool user_must_be_member = False;
Create an auth_serversupplied_info structure for a connection_struct
****************************************************************************/
-static NTSTATUS create_connection_server_info(struct smbd_server_connection *sconn,
+static NTSTATUS create_connection_session_info(struct smbd_server_connection *sconn,
TALLOC_CTX *mem_ctx, int snum,
struct auth_serversupplied_info *vuid_serverinfo,
DATA_BLOB password,
}
} else {
if (!user_ok_token(vuid_serverinfo->unix_name,
- pdb_get_domain(vuid_serverinfo->sam_account),
- vuid_serverinfo->ptok, snum)) {
+ vuid_serverinfo->info3->base.domain.string,
+ vuid_serverinfo->security_token, snum)) {
DEBUG(2, ("user '%s' (from session setup) not "
"permitted to access this share "
"(%s)\n",
return NT_STATUS_ACCESS_DENIED;
}
+/****************************************************************************
+ set relavent user and group settings corresponding to force user/group
+ configuration for the given snum.
+****************************************************************************/
+
+NTSTATUS set_conn_force_user_group(connection_struct *conn, int snum)
+{
+ NTSTATUS status;
+
+ if (*lp_force_user(snum)) {
+
+ /*
+ * Replace conn->session_info with a completely faked up one
+ * from the username we are forced into :-)
+ */
+
+ char *fuser;
+ struct auth_serversupplied_info *forced_serverinfo;
+
+ fuser = talloc_string_sub(conn, lp_force_user(snum), "%S",
+ lp_const_servicename(snum));
+ if (fuser == NULL) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ status = make_serverinfo_from_username(
+ conn, fuser, conn->session_info->guest,
+ &forced_serverinfo);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ TALLOC_FREE(conn->session_info);
+ conn->session_info = forced_serverinfo;
+
+ conn->force_user = true;
+ DEBUG(3,("Forced user %s\n", fuser));
+ }
+
+ /*
+ * If force group is true, then override
+ * any groupid stored for the connecting user.
+ */
+
+ if (*lp_force_group(snum)) {
+
+ status = find_forced_group(
+ conn->force_user, snum, conn->session_info->unix_name,
+ &conn->session_info->security_token->sids[1],
+ &conn->session_info->utok.gid);
+
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ /*
+ * We need to cache this gid, to use within
+ * change_to_user() separately from the conn->session_info
+ * struct. We only use conn->session_info directly if
+ * "force_user" was set.
+ */
+ conn->force_group_gid = conn->session_info->utok.gid;
+ }
+
+ return NT_STATUS_OK;
+}
/****************************************************************************
Make a connection, given the snum to connect to, and the vuser of the
const char *pdev,
NTSTATUS *pstatus)
{
- connection_struct *conn;
+ connection_struct *conn = NULL;
struct smb_filename *smb_fname_cpath = NULL;
fstring dev;
int ret;
- char addr[INET6_ADDRSTRLEN];
bool on_err_call_dis_hook = false;
+ bool claimed_connection = false;
+ uid_t effuid;
+ gid_t effgid;
NTSTATUS status;
fstrcpy(dev, pdev);
- if (NT_STATUS_IS_ERR(*pstatus = share_sanity_checks(snum, dev))) {
- return NULL;
- }
+ *pstatus = share_sanity_checks(&sconn->client_id, snum, dev);
+ if (NT_STATUS_IS_ERR(*pstatus)) {
+ goto err_root_exit;
+ }
conn = conn_new(sconn);
if (!conn) {
DEBUG(0,("Couldn't find free connection.\n"));
*pstatus = NT_STATUS_INSUFFICIENT_RESOURCES;
- return NULL;
+ goto err_root_exit;
}
conn->params->service = snum;
- status = create_connection_server_info(sconn,
- conn, snum, vuser ? vuser->server_info : NULL, password,
- &conn->server_info);
+ status = create_connection_session_info(sconn,
+ conn, snum, vuser ? vuser->session_info : NULL, password,
+ &conn->session_info);
if (!NT_STATUS_IS_OK(status)) {
- DEBUG(1, ("create_connection_server_info failed: %s\n",
+ DEBUG(1, ("create_connection_session_info failed: %s\n",
nt_errstr(status)));
*pstatus = status;
- conn_free(conn);
- return NULL;
+ goto err_root_exit;
}
if ((lp_guest_only(snum)) || (lp_security() == SEC_SHARE)) {
conn->force_user = true;
}
- add_session_user(sconn, conn->server_info->unix_name);
+ add_session_user(sconn, conn->session_info->unix_name);
- safe_strcpy(conn->client_address,
- client_addr(get_client_fd(),addr,sizeof(addr)),
- sizeof(conn->client_address)-1);
conn->num_files_open = 0;
conn->lastused = conn->lastused_count = time(NULL);
conn->used = True;
conn->aio_write_behind_list = NULL;
conn->read_only = lp_readonly(SNUM(conn));
- conn->admin_user = False;
-
- if (*lp_force_user(snum)) {
-
- /*
- * Replace conn->server_info with a completely faked up one
- * from the username we are forced into :-)
- */
-
- char *fuser;
- struct auth_serversupplied_info *forced_serverinfo;
-
- fuser = talloc_string_sub(conn, lp_force_user(snum), "%S",
- lp_servicename(snum));
- if (fuser == NULL) {
- conn_free(conn);
- *pstatus = NT_STATUS_NO_MEMORY;
- return NULL;
- }
-
- status = make_serverinfo_from_username(
- conn, fuser, conn->server_info->guest,
- &forced_serverinfo);
- if (!NT_STATUS_IS_OK(status)) {
- conn_free(conn);
- *pstatus = status;
- return NULL;
- }
-
- TALLOC_FREE(conn->server_info);
- conn->server_info = forced_serverinfo;
-
- conn->force_user = True;
- DEBUG(3,("Forced user %s\n", fuser));
- }
-
- /*
- * If force group is true, then override
- * any groupid stored for the connecting user.
- */
-
- if (*lp_force_group(snum)) {
-
- status = find_forced_group(
- conn->force_user, snum, conn->server_info->unix_name,
- &conn->server_info->ptok->user_sids[1],
- &conn->server_info->utok.gid);
-
- if (!NT_STATUS_IS_OK(status)) {
- conn_free(conn);
- *pstatus = status;
- return NULL;
- }
- /*
- * We need to cache this gid, to use within
- * change_to_user() separately from the conn->server_info
- * struct. We only use conn->server_info directly if
- * "force_user" was set.
- */
- conn->force_group_gid = conn->server_info->utok.gid;
+ status = set_conn_force_user_group(conn, snum);
+ if (!NT_STATUS_IS_OK(status)) {
+ conn_free(conn);
+ *pstatus = status;
+ return NULL;
}
conn->vuid = (vuser != NULL) ? vuser->vuid : UID_FIELD_INVALID;
{
char *s = talloc_sub_advanced(talloc_tos(),
lp_servicename(SNUM(conn)),
- conn->server_info->unix_name,
+ conn->session_info->unix_name,
conn->connectpath,
- conn->server_info->utok.gid,
- conn->server_info->sanitized_username,
- pdb_get_domain(conn->server_info->sam_account),
+ conn->session_info->utok.gid,
+ conn->session_info->sanitized_username,
+ conn->session_info->info3->base.domain.string,
lp_pathname(snum));
if (!s) {
- conn_free(conn);
*pstatus = NT_STATUS_NO_MEMORY;
- return NULL;
+ goto err_root_exit;
}
if (!set_conn_connectpath(conn,s)) {
TALLOC_FREE(s);
- conn_free(conn);
*pstatus = NT_STATUS_NO_MEMORY;
- return NULL;
+ goto err_root_exit;
}
DEBUG(3,("Connect path is '%s' for service [%s]\n",s,
lp_servicename(snum)));
{
bool can_write = False;
- can_write = share_access_check(conn->server_info->ptok,
+ can_write = share_access_check(conn->session_info->security_token,
lp_servicename(snum),
FILE_WRITE_DATA);
if (!can_write) {
- if (!share_access_check(conn->server_info->ptok,
+ if (!share_access_check(conn->session_info->security_token,
lp_servicename(snum),
FILE_READ_DATA)) {
/* No access, read or write. */
"denied due to security "
"descriptor.\n",
lp_servicename(snum)));
- conn_free(conn);
*pstatus = NT_STATUS_ACCESS_DENIED;
- return NULL;
+ goto err_root_exit;
} else {
conn->read_only = True;
}
if (!smbd_vfs_init(conn)) {
DEBUG(0, ("vfs_init failed for service %s\n",
lp_servicename(snum)));
- conn_free(conn);
*pstatus = NT_STATUS_BAD_NETWORK_NAME;
- return NULL;
- }
-
- if ((!conn->printer) && (!conn->ipc)) {
- conn->notify_ctx = notify_init(conn, server_id_self(),
- smbd_messaging_context(),
- smbd_event_context(),
- conn);
+ goto err_root_exit;
}
/* ROOT Activities: */
DEBUG(1, ("Max connections (%d) exceeded for %s\n",
lp_max_connections(snum), lp_servicename(snum)));
- conn_free(conn);
*pstatus = NT_STATUS_INSUFFICIENT_RESOURCES;
- return NULL;
- }
+ goto err_root_exit;
+ }
/*
* Get us an entry in the connections db
*/
- if (!claim_connection(conn, lp_servicename(snum), 0)) {
+ if (!claim_connection(conn, lp_servicename(snum))) {
DEBUG(1, ("Could not store connections entry\n"));
- conn_free(conn);
*pstatus = NT_STATUS_INTERNAL_DB_ERROR;
- return NULL;
- }
+ goto err_root_exit;
+ }
+ claimed_connection = true;
+
+ /* Invoke VFS make connection hook - this must be the first
+ filesystem operation that we do. */
+
+ if (SMB_VFS_CONNECT(conn, lp_servicename(snum),
+ conn->session_info->unix_name) < 0) {
+ DEBUG(0,("make_connection: VFS make connection failed!\n"));
+ *pstatus = NT_STATUS_UNSUCCESSFUL;
+ goto err_root_exit;
+ }
+
+ /* Any error exit after here needs to call the disconnect hook. */
+ on_err_call_dis_hook = true;
+
+ if ((!conn->printer) && (!conn->ipc)) {
+ conn->notify_ctx = notify_init(conn,
+ sconn_server_id(sconn),
+ sconn->msg_ctx,
+ smbd_event_context(),
+ conn);
+ }
/*
* Fix compatibility issue pointed out by Volker.
if (*lp_rootpreexec(snum)) {
char *cmd = talloc_sub_advanced(talloc_tos(),
lp_servicename(SNUM(conn)),
- conn->server_info->unix_name,
+ conn->session_info->unix_name,
conn->connectpath,
- conn->server_info->utok.gid,
- conn->server_info->sanitized_username,
- pdb_get_domain(conn->server_info->sam_account),
+ conn->session_info->utok.gid,
+ conn->session_info->sanitized_username,
+ conn->session_info->info3->base.domain.string,
lp_rootpreexec(snum));
DEBUG(5,("cmd=%s\n",cmd));
ret = smbrun(cmd,NULL);
if (ret != 0 && lp_rootpreexec_close(snum)) {
DEBUG(1,("root preexec gave %d - failing "
"connection\n", ret));
- yield_connection(conn, lp_servicename(snum));
- conn_free(conn);
*pstatus = NT_STATUS_ACCESS_DENIED;
- return NULL;
+ goto err_root_exit;
}
}
if (!change_to_user(conn, conn->vuid)) {
/* No point continuing if they fail the basic checks */
DEBUG(0,("Can't become connected user!\n"));
- yield_connection(conn, lp_servicename(snum));
- conn_free(conn);
*pstatus = NT_STATUS_LOGON_FAILURE;
- return NULL;
+ goto err_root_exit;
}
+ effuid = geteuid();
+ effgid = getegid();
+
/* Remember that a different vuid can connect later without these
* checks... */
-
+
/* Preexecs are done here as they might make the dir we are to ChDir
* to below */
if (*lp_preexec(snum)) {
char *cmd = talloc_sub_advanced(talloc_tos(),
lp_servicename(SNUM(conn)),
- conn->server_info->unix_name,
+ conn->session_info->unix_name,
conn->connectpath,
- conn->server_info->utok.gid,
- conn->server_info->sanitized_username,
- pdb_get_domain(conn->server_info->sam_account),
+ conn->session_info->utok.gid,
+ conn->session_info->sanitized_username,
+ conn->session_info->info3->base.domain.string,
lp_preexec(snum));
ret = smbrun(cmd,NULL);
TALLOC_FREE(cmd);
}
}
+#ifdef WITH_FAKE_KASERVER
+ if (lp_afs_share(snum)) {
+ afs_login(conn);
+ }
+#endif
+
+ /*
+ * we've finished with the user stuff - go back to root
+ * so the SMB_VFS_STAT call will only fail on path errors,
+ * not permission problems.
+ */
+ change_to_root_user();
+/* ROOT Activites: */
+
/*
* If widelinks are disallowed we need to canonicalise the connect
* path here to ensure we don't have any symlinks in the
}
}
-#ifdef WITH_FAKE_KASERVER
- if (lp_afs_share(snum)) {
- afs_login(conn);
- }
-#endif
-
/* Add veto/hide lists */
if (!IS_IPC(conn) && !IS_PRINT(conn)) {
set_namearray( &conn->veto_list, lp_veto_files(snum));
set_namearray( &conn->aio_write_behind_list,
lp_aio_write_behind(snum));
}
-
- /* Invoke VFS make connection hook - do this before the VFS_STAT call
- to allow any filesystems needing user credentials to initialize
- themselves. */
-
- if (SMB_VFS_CONNECT(conn, lp_servicename(snum),
- conn->server_info->unix_name) < 0) {
- DEBUG(0,("make_connection: VFS make connection failed!\n"));
- *pstatus = NT_STATUS_UNSUCCESSFUL;
- goto err_root_exit;
- }
-
- /* Any error exit after here needs to call the disconnect hook. */
- on_err_call_dis_hook = true;
-
status = create_synthetic_smb_fname(talloc_tos(), conn->connectpath,
NULL, NULL, &smb_fname_cpath);
if (!NT_STATUS_IS_OK(status)) {
check during individual operations. To match this behaviour
I have disabled this chdir check (tridge) */
/* the alternative is just to check the directory exists */
- if (SMB_VFS_STAT(conn, smb_fname_cpath) == 0) {
- if (!S_ISDIR(smb_fname_cpath->st.st_ex_mode)) {
+
+ if ((ret = SMB_VFS_STAT(conn, smb_fname_cpath)) != 0 ||
+ !S_ISDIR(smb_fname_cpath->st.st_ex_mode)) {
+ if (ret == 0 && !S_ISDIR(smb_fname_cpath->st.st_ex_mode)) {
DEBUG(0,("'%s' is not a directory, when connecting to "
"[%s]\n", conn->connectpath,
lp_servicename(snum)));
- *pstatus = NT_STATUS_BAD_NETWORK_NAME;
- goto err_root_exit;
- }
- } else {
- /* Stat failed. Bail on any error except permission denied. */
- if (errno != EACCES) {
- DEBUG(0,("Connecting to share [%s], path '%s' "
- "gives error %s\n",
- lp_servicename(snum),
- conn->connectpath,
+ } else {
+ DEBUG(0,("'%s' does not exist or permission denied "
+ "when connecting to [%s] Error was %s\n",
+ conn->connectpath, lp_servicename(snum),
strerror(errno) ));
- *pstatus = NT_STATUS_BAD_NETWORK_NAME;
- goto err_root_exit;
}
- /* As Windows does, on permsission denied we continue.
- * Pathname calls fail, not TconX calls. */
+ *pstatus = NT_STATUS_BAD_NETWORK_NAME;
+ goto err_root_exit;
}
+ conn->base_share_dev = smb_fname_cpath->st.st_ex_dev;
string_set(&conn->origpath,conn->connectpath);
-#if SOFTLINK_OPTIMISATION
- /* resolve any soft links early if possible */
- if (vfs_ChDir(conn,conn->connectpath) == 0) {
- TALLOC_CTX *ctx = talloc_tos();
- char *s = vfs_GetWd(ctx,s);
- if (!s) {
- *status = map_nt_error_from_unix(errno);
- goto err_root_exit;
- }
- if (!set_conn_connectpath(conn,s)) {
- *status = NT_STATUS_NO_MEMORY;
- goto err_root_exit;
- }
- vfs_ChDir(conn,conn->connectpath);
- }
-#endif
-
/* Figure out the characteristics of the underlying filesystem. This
* assumes that all the filesystem mounted withing a share path have
* the same characteristics, which is likely but not guaranteed.
if( DEBUGLVL( IS_IPC(conn) ? 3 : 1 ) ) {
dbgtext( "%s (%s) ", get_remote_machine_name(),
- conn->client_address );
- dbgtext( "%s", srv_is_signing_active(smbd_server_conn) ? "signed " : "");
+ conn->sconn->client_id.addr );
+ dbgtext( "%s", srv_is_signing_active(sconn) ? "signed " : "");
dbgtext( "connect to service %s ", lp_servicename(snum) );
dbgtext( "initially as user %s ",
- conn->server_info->unix_name );
- dbgtext( "(uid=%d, gid=%d) ", (int)geteuid(), (int)getegid() );
+ conn->session_info->unix_name );
+ dbgtext( "(uid=%d, gid=%d) ", (int)effuid, (int)effgid );
dbgtext( "(pid %d)\n", (int)sys_getpid() );
}
- /* we've finished with the user stuff - go back to root */
- change_to_root_user();
return(conn);
err_root_exit:
TALLOC_FREE(smb_fname_cpath);
- change_to_root_user();
+ /* We must exit this function as root. */
+ if (geteuid() != 0) {
+ change_to_root_user();
+ }
if (on_err_call_dis_hook) {
/* Call VFS disconnect hook */
SMB_VFS_DISCONNECT(conn);
}
- yield_connection(conn, lp_servicename(snum));
- conn_free(conn);
+ if (claimed_connection) {
+ yield_connection(conn, lp_servicename(snum));
+ }
+ if (conn) {
+ conn_free(conn);
+ }
return NULL;
}
{
uid_t euid;
user_struct *vuser = NULL;
- fstring service;
+ char *service = NULL;
fstring dev;
int snum = -1;
- char addr[INET6_ADDRSTRLEN];
fstrcpy(dev, pdev);
/* Security = share. Try with
* current_user_info.smb_name as the username. */
if (*current_user_info.smb_name) {
- fstring unix_username;
- fstrcpy(unix_username,
- current_user_info.smb_name);
- map_username(sconn, unix_username);
- snum = find_service(unix_username);
- }
+ char *unix_username = NULL;
+ (void)map_username(talloc_tos(),
+ current_user_info.smb_name,
+ &unix_username);
+ snum = find_service(talloc_tos(),
+ unix_username,
+ &unix_username);
+ if (!unix_username) {
+ *status = NT_STATUS_NO_MEMORY;
+ }
+ return NULL;
+ }
if (snum != -1) {
DEBUG(5, ("making a connection to 'homes' "
"service %s based on "
vuser, no_pw,
dev, status);
}
-
- fstrcpy(service, service_in);
+
+ service = talloc_strdup(talloc_tos(), service_in);
+ if (!service) {
+ *status = NT_STATUS_NO_MEMORY;
+ return NULL;
+ }
strlower_m(service);
- snum = find_service(service);
+ snum = find_service(talloc_tos(), service, &service);
+ if (!service) {
+ *status = NT_STATUS_NO_MEMORY;
+ return NULL;
+ }
if (snum < 0) {
if (strequal(service,"IPC$") ||
DEBUG(3,("%s (%s) couldn't find service %s\n",
get_remote_machine_name(),
- client_addr(get_client_fd(),addr,sizeof(addr)),
+ tsocket_address_string(
+ sconn->remote_address, talloc_tos()),
service));
*status = NT_STATUS_BAD_NETWORK_NAME;
return NULL;
DEBUG(IS_IPC(conn)?3:1, ("%s (%s) closed connection to service %s\n",
get_remote_machine_name(),
- conn->client_address,
+ conn->sconn->client_id.addr,
lp_servicename(SNUM(conn))));
/* Call VFS disconnect hook */
change_to_user(conn, vuid)) {
char *cmd = talloc_sub_advanced(talloc_tos(),
lp_servicename(SNUM(conn)),
- conn->server_info->unix_name,
+ conn->session_info->unix_name,
conn->connectpath,
- conn->server_info->utok.gid,
- conn->server_info->sanitized_username,
- pdb_get_domain(conn->server_info->sam_account),
+ conn->session_info->utok.gid,
+ conn->session_info->sanitized_username,
+ conn->session_info->info3->base.domain.string,
lp_postexec(SNUM(conn)));
smbrun(cmd,NULL);
TALLOC_FREE(cmd);
if (*lp_rootpostexec(SNUM(conn))) {
char *cmd = talloc_sub_advanced(talloc_tos(),
lp_servicename(SNUM(conn)),
- conn->server_info->unix_name,
+ conn->session_info->unix_name,
conn->connectpath,
- conn->server_info->utok.gid,
- conn->server_info->sanitized_username,
- pdb_get_domain(conn->server_info->sam_account),
+ conn->session_info->utok.gid,
+ conn->session_info->sanitized_username,
+ conn->session_info->info3->base.domain.string,
lp_rootpostexec(SNUM(conn)));
smbrun(cmd,NULL);
TALLOC_FREE(cmd);
git.samba.org / amitay / samba.git / blobdiff