This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
-extern struct timeval smb_last_time;
extern userdom_struct current_user_info;
+static bool canonicalize_connect_path(connection_struct *conn)
+{
+#ifdef REALPATH_TAKES_NULL
+ bool ret;
+ char *resolved_name = SMB_VFS_REALPATH(conn,conn->connectpath,NULL);
+ if (!resolved_name) {
+ return false;
+ }
+ ret = set_conn_connectpath(conn,resolved_name);
+ SAFE_FREE(resolved_name);
+ return ret;
+#else
+ char resolved_name_buf[PATH_MAX+1];
+ char *resolved_name = SMB_VFS_REALPATH(conn,conn->connectpath,resolved_name_buf);
+ if (!resolved_name) {
+ return false;
+ }
+ return set_conn_connectpath(conn,resolved_name);
+#endif /* REALPATH_TAKES_NULL */
+}
+
/****************************************************************************
Ensure when setting connectpath it is a canonicalized (no ./ // or ../)
absolute path stating in / and not ending in /.
Observent people will notice a similarity between this and check_path_syntax :-).
****************************************************************************/
-void set_conn_connectpath(connection_struct *conn, const pstring connectpath)
+bool set_conn_connectpath(connection_struct *conn, const char *connectpath)
{
- pstring destname;
- char *d = destname;
+ char *destname;
+ char *d;
const char *s = connectpath;
- BOOL start_of_name_component = True;
+ bool start_of_name_component = true;
+
+ destname = SMB_STRDUP(connectpath);
+ if (!destname) {
+ return false;
+ }
+ d = destname;
*d++ = '/'; /* Always start with root. */
if (!(*s & 0x80)) {
*d++ = *s++;
} else {
- switch(next_mb_char_size(s)) {
+ size_t siz;
+ /* Get the size of the next MB character. */
+ next_codepoint(s,&siz);
+ switch(siz) {
+ case 5:
+ *d++ = *s++;
+ /*fall through*/
case 4:
*d++ = *s++;
+ /*fall through*/
case 3:
*d++ = *s++;
+ /*fall through*/
case 2:
*d++ = *s++;
+ /*fall through*/
case 1:
*d++ = *s++;
break;
break;
}
}
- start_of_name_component = False;
+ start_of_name_component = false;
}
*d = '\0';
lp_servicename(SNUM(conn)), destname ));
string_set(&conn->connectpath, destname);
+ SAFE_FREE(destname);
+ return true;
}
/****************************************************************************
Load parameters specific to a connection/service.
****************************************************************************/
-BOOL set_current_service(connection_struct *conn, uint16 flags, BOOL do_chdir)
+bool set_current_service(connection_struct *conn, uint16 flags, bool do_chdir)
{
static connection_struct *last_conn;
static uint16 last_flags;
return(False);
}
- conn->lastused = smb_last_time.tv_sec;
+ conn->lastused_count++;
snum = SNUM(conn);
return(True);
}
+static int load_registry_service(const char *servicename)
+{
+ struct registry_key *key;
+ char *path;
+ WERROR err;
+
+ uint32 i;
+ char *value_name;
+ struct registry_value *value;
+
+ int res = -1;
+
+ if (!lp_registry_shares()) {
+ return -1;
+ }
+
+ if (strequal(servicename, GLOBAL_NAME)) {
+ return -2;
+ }
+
+ if (asprintf(&path, "%s\\%s", KEY_SMBCONF, servicename) == -1) {
+ return -1;
+ }
+
+ err = reg_open_path(NULL, path, REG_KEY_READ, get_root_nt_token(),
+ &key);
+ SAFE_FREE(path);
+
+ if (!W_ERROR_IS_OK(err)) {
+ return -1;
+ }
+
+ res = lp_add_service(servicename, -1);
+ if (res == -1) {
+ goto error;
+ }
+
+ for (i=0;
+ W_ERROR_IS_OK(reg_enumvalue(key, key, i, &value_name, &value));
+ i++) {
+ switch (value->type) {
+ case REG_DWORD: {
+ char *tmp;
+ if (asprintf(&tmp, "%d", value->v.dword) == -1) {
+ continue;
+ }
+ lp_do_parameter(res, value_name, tmp);
+ SAFE_FREE(tmp);
+ break;
+ }
+ case REG_SZ: {
+ lp_do_parameter(res, value_name, value->v.sz.str);
+ break;
+ }
+ default:
+ /* Ignore all the rest */
+ break;
+ }
+
+ TALLOC_FREE(value_name);
+ TALLOC_FREE(value);
+ }
+
+ error:
+
+ TALLOC_FREE(key);
+ return res;
+}
+
+void load_registry_shares(void)
+{
+ struct registry_key *key;
+ char *name;
+ WERROR err;
+ int i;
+
+ DEBUG(8, ("load_registry_shares()\n"));
+ if (!lp_registry_shares()) {
+ return;
+ }
+
+ err = reg_open_path(NULL, KEY_SMBCONF, REG_KEY_READ,
+ get_root_nt_token(), &key);
+ if (!(W_ERROR_IS_OK(err))) {
+ return;
+ }
+
+ for (i=0; W_ERROR_IS_OK(reg_enumkey(key, key, i, &name, NULL)); i++) {
+ load_registry_service(name);
+ TALLOC_FREE(name);
+ }
+
+ TALLOC_FREE(key);
+ return;
+}
+
/****************************************************************************
Add a home service. Returns the new service number or -1 if fail.
****************************************************************************/
if (!service || !homedir)
return -1;
- if ((iHomeService = lp_servicenumber(HOMES_NAME)) < 0)
- return -1;
+ if ((iHomeService = lp_servicenumber(HOMES_NAME)) < 0) {
+ if ((iHomeService = load_registry_service(HOMES_NAME)) < 0) {
+ return -1;
+ }
+ }
/*
* If this is a winbindd provided username, remove
}
-
/**
* Find a service entry.
*
/* now handle the special case of a home directory */
if (iService < 0) {
- char *phome_dir = get_user_home_dir(service);
+ char *phome_dir = get_user_home_dir(talloc_tos(), service);
if(!phome_dir) {
/*
* be a Windows to unix mapped user name.
*/
if(map_username(service))
- phome_dir = get_user_home_dir(service);
+ phome_dir = get_user_home_dir(
+ talloc_tos(), service);
}
DEBUG(3,("checking for home directory %s gave %s\n",service,
if (iService < 0) {
int iPrinterService;
- if ((iPrinterService = lp_servicenumber(PRINTERS_NAME)) >= 0) {
+ if ((iPrinterService = lp_servicenumber(PRINTERS_NAME)) < 0) {
+ iPrinterService = load_registry_service(PRINTERS_NAME);
+ }
+ if (iPrinterService) {
DEBUG(3,("checking whether %s is a valid printer name...\n", service));
if (pcap_printername_ok(service)) {
DEBUG(3,("%s is a valid printer name\n", service));
if (iService < 0) {
}
+ if (iService < 0) {
+ iService = load_registry_service(service);
+ }
+
+ /* Is it a usershare service ? */
+ if (iService < 0 && *lp_usershare_path()) {
+ /* Ensure the name is canonicalized. */
+ strlower_m(service);
+ iService = load_usershare_service(service);
+ }
+
/* just possibly it's a default service? */
if (iService < 0) {
char *pdefservice = lp_defaultservice();
* could get overwritten by the recursive find_service() call
* below. Fix from Josef Hinteregger <joehtg@joehtg.co.at>.
*/
- pstring defservice;
- pstrcpy(defservice, pdefservice);
+ char *defservice = SMB_STRDUP(pdefservice);
+
+ if (!defservice) {
+ goto fail;
+ }
+
+ /* Disallow anything except explicit share names. */
+ if (strequal(defservice,HOMES_NAME) ||
+ strequal(defservice, PRINTERS_NAME) ||
+ strequal(defservice, "IPC$")) {
+ SAFE_FREE(defservice);
+ goto fail;
+ }
+
iService = find_service(defservice);
if (iService >= 0) {
all_string_sub(service, "_","/",0);
iService = lp_add_service(service, iService);
}
+ SAFE_FREE(defservice);
}
}
}
}
+ fail:
+
if (iService < 0)
DEBUG(3,("find_service() failed to find service %s\n", service));
return NT_STATUS_OK;
}
+/*
+ * Go through lookup_name etc to find the force'd group.
+ *
+ * Create a new token from src_token, replacing the primary group sid with the
+ * one found.
+ */
+
+static NTSTATUS find_forced_group(bool force_user,
+ int snum, const char *username,
+ DOM_SID *pgroup_sid,
+ gid_t *pgid)
+{
+ NTSTATUS result = NT_STATUS_NO_SUCH_GROUP;
+ TALLOC_CTX *frame = talloc_stackframe();
+ DOM_SID group_sid;
+ enum lsa_SidType type;
+ char *groupname;
+ bool user_must_be_member = False;
+ gid_t gid;
+
+ groupname = talloc_strdup(talloc_tos(), lp_force_group(snum));
+ if (groupname == NULL) {
+ DEBUG(1, ("talloc_strdup failed\n"));
+ result = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
+
+ if (groupname[0] == '+') {
+ user_must_be_member = True;
+ groupname += 1;
+ }
+
+ groupname = talloc_string_sub(talloc_tos(), groupname,
+ "%S", lp_servicename(snum));
+ if (groupname == NULL) {
+ DEBUG(1, ("talloc_string_sub failed\n"));
+ result = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
+
+ if (!lookup_name_smbconf(talloc_tos(), groupname,
+ LOOKUP_NAME_ALL|LOOKUP_NAME_GROUP,
+ NULL, NULL, &group_sid, &type)) {
+ DEBUG(10, ("lookup_name_smbconf(%s) failed\n",
+ groupname));
+ goto done;
+ }
+
+ if ((type != SID_NAME_DOM_GRP) && (type != SID_NAME_ALIAS) &&
+ (type != SID_NAME_WKN_GRP)) {
+ DEBUG(10, ("%s is a %s, not a group\n", groupname,
+ sid_type_lookup(type)));
+ goto done;
+ }
+
+ if (!sid_to_gid(&group_sid, &gid)) {
+ DEBUG(10, ("sid_to_gid(%s) for %s failed\n",
+ sid_string_dbg(&group_sid), groupname));
+ goto done;
+ }
+
+ /*
+ * If the user has been forced and the forced group starts with a '+',
+ * then we only set the group to be the forced group if the forced
+ * user is a member of that group. Otherwise, the meaning of the '+'
+ * would be ignored.
+ */
+
+ if (force_user && user_must_be_member) {
+ if (user_in_group_sid(username, &group_sid)) {
+ sid_copy(pgroup_sid, &group_sid);
+ *pgid = gid;
+ DEBUG(3,("Forced group %s for member %s\n",
+ groupname, username));
+ } else {
+ DEBUG(0,("find_forced_group: forced user %s is not a member "
+ "of forced group %s. Disallowing access.\n",
+ username, groupname ));
+ result = NT_STATUS_MEMBER_NOT_IN_GROUP;
+ goto done;
+ }
+ } else {
+ sid_copy(pgroup_sid, &group_sid);
+ *pgid = gid;
+ DEBUG(3,("Forced group %s\n", groupname));
+ }
+
+ result = NT_STATUS_OK;
+ done:
+ TALLOC_FREE(frame);
+ return result;
+}
+
+/****************************************************************************
+ Create an auth_serversupplied_info structure for a connection_struct
+****************************************************************************/
+
+static NTSTATUS create_connection_server_info(TALLOC_CTX *mem_ctx, int snum,
+ struct auth_serversupplied_info *vuid_serverinfo,
+ DATA_BLOB password,
+ struct auth_serversupplied_info **presult)
+{
+ if (lp_guest_only(snum)) {
+ return make_server_info_guest(mem_ctx, presult);
+ }
+
+ if (vuid_serverinfo != NULL) {
+
+ struct auth_serversupplied_info *result;
+
+ /*
+ * This is the normal security != share case where we have a
+ * valid vuid from the session setup. */
+
+ if (vuid_serverinfo->guest) {
+ if (!lp_guest_ok(snum)) {
+ DEBUG(2, ("guest user (from session setup) "
+ "not permitted to access this share "
+ "(%s)\n", lp_servicename(snum)));
+ return NT_STATUS_ACCESS_DENIED;
+ }
+ } else {
+ if (!user_ok_token(vuid_serverinfo->unix_name,
+ pdb_get_domain(vuid_serverinfo->sam_account),
+ vuid_serverinfo->ptok, snum)) {
+ DEBUG(2, ("user '%s' (from session setup) not "
+ "permitted to access this share "
+ "(%s)\n",
+ vuid_serverinfo->unix_name,
+ lp_servicename(snum)));
+ return NT_STATUS_ACCESS_DENIED;
+ }
+ }
+
+ result = copy_serverinfo(mem_ctx, vuid_serverinfo);
+ if (result == NULL) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ *presult = result;
+ return NT_STATUS_OK;
+ }
+
+ if (lp_security() == SEC_SHARE) {
+
+ fstring user;
+ bool guest;
+
+ /* add the sharename as a possible user name if we
+ are in share mode security */
+
+ add_session_user(lp_servicename(snum));
+
+ /* shall we let them in? */
+
+ if (!authorise_login(snum,user,password,&guest)) {
+ DEBUG( 2, ( "Invalid username/password for [%s]\n",
+ lp_servicename(snum)) );
+ return NT_STATUS_WRONG_PASSWORD;
+ }
+
+ return make_serverinfo_from_username(mem_ctx, user, guest,
+ presult);
+ }
+
+ DEBUG(0, ("invalid VUID (vuser) but not in security=share\n"));
+ return NT_STATUS_ACCESS_DENIED;
+}
+
+
/****************************************************************************
Make a connection, given the snum to connect to, and the vuser of the
connecting user if appropriate.
static connection_struct *make_connection_snum(int snum, user_struct *vuser,
DATA_BLOB password,
const char *pdev,
- NTSTATUS *status)
+ NTSTATUS *pstatus)
{
- struct passwd *pass = NULL;
- BOOL guest = False;
connection_struct *conn;
SMB_STRUCT_STAT st;
- fstring user;
fstring dev;
int ret;
+ char addr[INET6_ADDRSTRLEN];
+ bool on_err_call_dis_hook = false;
+ NTSTATUS status;
- *user = 0;
fstrcpy(dev, pdev);
SET_STAT_INVALID(st);
- if (NT_STATUS_IS_ERR(*status = share_sanity_checks(snum, dev))) {
+ if (NT_STATUS_IS_ERR(*pstatus = share_sanity_checks(snum, dev))) {
return NULL;
}
conn = conn_new();
if (!conn) {
DEBUG(0,("Couldn't find free connection.\n"));
- *status = NT_STATUS_INSUFFICIENT_RESOURCES;
+ *pstatus = NT_STATUS_INSUFFICIENT_RESOURCES;
return NULL;
}
- if (lp_guest_only(snum)) {
- const char *guestname = lp_guestaccount();
- guest = True;
- pass = getpwnam_alloc(guestname);
- if (!pass) {
- DEBUG(0,("make_connection_snum: Invalid guest "
- "account %s??\n",guestname));
- conn_free(conn);
- *status = NT_STATUS_NO_SUCH_USER;
- return NULL;
- }
- fstrcpy(user,pass->pw_name);
- conn->force_user = True;
- conn->uid = pass->pw_uid;
- conn->gid = pass->pw_gid;
- string_set(&conn->user,pass->pw_name);
- passwd_free(&pass);
- DEBUG(3,("Guest only user %s\n",user));
- } else if (vuser) {
- if (vuser->guest) {
- if (!lp_guest_ok(snum)) {
- DEBUG(2, ("guest user (from session setup) "
- "not permitted to access this share "
- "(%s)\n", lp_servicename(snum)));
- conn_free(conn);
- *status = NT_STATUS_ACCESS_DENIED;
- return NULL;
- }
- } else {
- if (!user_ok(vuser->user.unix_name, snum,
- vuser->groups, vuser->n_groups)) {
- DEBUG(2, ("user '%s' (from session setup) not "
- "permitted to access this share "
- "(%s)\n", vuser->user.unix_name,
- lp_servicename(snum)));
- conn_free(conn);
- *status = NT_STATUS_ACCESS_DENIED;
- return NULL;
- }
- }
- conn->vuid = vuser->vuid;
- conn->uid = vuser->uid;
- conn->gid = vuser->gid;
- string_set(&conn->user,vuser->user.unix_name);
- fstrcpy(user,vuser->user.unix_name);
- guest = vuser->guest;
- } else if (lp_security() == SEC_SHARE) {
- /* add it as a possible user name if we
- are in share mode security */
- add_session_user(lp_servicename(snum));
- /* shall we let them in? */
- if (!authorise_login(snum,user,password,&guest)) {
- DEBUG( 2, ( "Invalid username/password for [%s]\n",
- lp_servicename(snum)) );
- conn_free(conn);
- *status = NT_STATUS_WRONG_PASSWORD;
- return NULL;
- }
- pass = Get_Pwnam(user);
- conn->force_user = True;
- conn->uid = pass->pw_uid;
- conn->gid = pass->pw_gid;
- string_set(&conn->user, pass->pw_name);
- fstrcpy(user, pass->pw_name);
+ conn->params->service = snum;
- } else {
- DEBUG(0, ("invalid VUID (vuser) but not in security=share\n"));
+ status = create_connection_server_info(
+ conn, snum, vuser ? vuser->server_info : NULL, password,
+ &conn->server_info);
+
+ if (!NT_STATUS_IS_OK(status)) {
+ DEBUG(0, ("create_connection_server_info failed: %s\n",
+ nt_errstr(status)));
+ *pstatus = status;
conn_free(conn);
- *status = NT_STATUS_ACCESS_DENIED;
return NULL;
}
- add_session_user(user);
+ if ((lp_guest_only(snum)) || (lp_security() == SEC_SHARE)) {
+ conn->force_user = true;
+ }
+
+ add_session_user(conn->server_info->unix_name);
- safe_strcpy(conn->client_address, client_addr(),
- sizeof(conn->client_address)-1);
+ safe_strcpy(conn->client_address,
+ client_addr(get_client_fd(),addr,sizeof(addr)),
+ sizeof(conn->client_address)-1);
conn->num_files_open = 0;
- conn->lastused = time(NULL);
- conn->service = snum;
+ conn->lastused = conn->lastused_count = time(NULL);
conn->used = True;
conn->printer = (strncmp(dev,"LPT",3) == 0);
conn->ipc = ( (strncmp(dev,"IPC",3) == 0) ||
* insensitive for now. */
conn->case_sensitive = False;
} else {
- conn->case_sensitive = (BOOL)lp_casesensitive(snum);
+ conn->case_sensitive = (bool)lp_casesensitive(snum);
}
conn->case_preserve = lp_preservecase(snum);
conn->short_case_preserve = lp_shortpreservecase(snum);
+ conn->encrypt_level = lp_smb_encrypt(snum);
+
conn->veto_list = NULL;
conn->hide_list = NULL;
conn->veto_oplock_list = NULL;
conn->aio_write_behind_list = NULL;
string_set(&conn->dirpath,"");
- string_set(&conn->user,user);
- conn->nt_user_token = NULL;
- conn->read_only = lp_readonly(conn->service);
+ conn->read_only = lp_readonly(SNUM(conn));
conn->admin_user = False;
- /*
- * If force user is true, then store the
- * given userid and also the groups
- * of the user we're forcing.
- */
-
if (*lp_force_user(snum)) {
- struct passwd *pass2;
- pstring fuser;
- pstrcpy(fuser,lp_force_user(snum));
-
- /* Allow %S to be used by force user. */
- pstring_sub(fuser,"%S",lp_servicename(snum));
-
- pass2 = (struct passwd *)Get_Pwnam(fuser);
- if (pass2) {
- conn->uid = pass2->pw_uid;
- conn->gid = pass2->pw_gid;
- string_set(&conn->user,pass2->pw_name);
- fstrcpy(user,pass2->pw_name);
- conn->force_user = True;
- DEBUG(3,("Forced user %s\n",user));
- } else {
- DEBUG(1,("Couldn't find user %s\n",fuser));
+
+ /*
+ * Replace conn->server_info with a completely faked up one
+ * from the username we are forced into :-)
+ */
+
+ char *fuser;
+ struct auth_serversupplied_info *forced_serverinfo;
+
+ fuser = talloc_string_sub(conn, lp_force_user(snum), "%S",
+ lp_servicename(snum));
+ if (fuser == NULL) {
+ conn_free(conn);
+ *pstatus = NT_STATUS_NO_MEMORY;
+ return NULL;
+ }
+
+ status = make_serverinfo_from_username(
+ conn, fuser, conn->server_info->guest,
+ &forced_serverinfo);
+ if (!NT_STATUS_IS_OK(status)) {
conn_free(conn);
- *status = NT_STATUS_NO_SUCH_USER;
+ *pstatus = status;
return NULL;
}
+
+ TALLOC_FREE(conn->server_info);
+ conn->server_info = forced_serverinfo;
+
+ conn->force_user = True;
+ DEBUG(3,("Forced user %s\n", fuser));
}
-#ifdef HAVE_GETGRNAM
/*
* If force group is true, then override
* any groupid stored for the connecting user.
*/
-
+
if (*lp_force_group(snum)) {
- gid_t gid;
- pstring gname;
- pstring tmp_gname;
- BOOL user_must_be_member = False;
-
- pstrcpy(tmp_gname,lp_force_group(snum));
-
- if (tmp_gname[0] == '+') {
- user_must_be_member = True;
- /* even now, tmp_gname is null terminated */
- pstrcpy(gname,&tmp_gname[1]);
- } else {
- pstrcpy(gname,tmp_gname);
- }
- /* default service may be a group name */
- pstring_sub(gname,"%S",lp_servicename(snum));
- gid = nametogid(gname);
-
- if (gid == (gid_t)-1) {
- DEBUG(1,("Couldn't find group %s\n",gname));
+
+ status = find_forced_group(
+ conn->force_user, snum, conn->server_info->unix_name,
+ &conn->server_info->ptok->user_sids[1],
+ &conn->server_info->utok.gid);
+
+ if (!NT_STATUS_IS_OK(status)) {
conn_free(conn);
- *status = NT_STATUS_NO_SUCH_GROUP;
+ *pstatus = status;
return NULL;
}
-
- /*
- * If the user has been forced and the forced group starts
- * with a '+', then we only set the group to be the forced
- * group if the forced user is a member of that group.
- * Otherwise, the meaning of the '+' would be ignored.
- */
- if (conn->force_user && user_must_be_member) {
- if (user_in_group_list( user, gname, NULL, 0)) {
- conn->gid = gid;
- DEBUG(3,("Forced group %s for member %s\n",
- gname,user));
- }
- } else {
- conn->gid = gid;
- DEBUG(3,("Forced group %s\n",gname));
- }
- conn->force_group = True;
}
-#endif /* HAVE_GETGRNAM */
+
+ conn->vuid = (vuser != NULL) ? vuser->vuid : UID_FIELD_INVALID;
{
- pstring s;
- pstrcpy(s,lp_pathname(snum));
- standard_sub_conn(conn,s,sizeof(s));
- set_conn_connectpath(conn,s);
+ char *s = talloc_sub_advanced(talloc_tos(),
+ lp_servicename(SNUM(conn)),
+ conn->server_info->unix_name,
+ conn->connectpath,
+ conn->server_info->utok.gid,
+ conn->server_info->sanitized_username,
+ pdb_get_domain(conn->server_info->sam_account),
+ lp_pathname(snum));
+ if (!s) {
+ conn_free(conn);
+ *pstatus = NT_STATUS_NO_MEMORY;
+ return NULL;
+ }
+
+ if (!set_conn_connectpath(conn,s)) {
+ TALLOC_FREE(s);
+ conn_free(conn);
+ *pstatus = NT_STATUS_NO_MEMORY;
+ return NULL;
+ }
DEBUG(3,("Connect path is '%s' for service [%s]\n",s,
lp_servicename(snum)));
- }
-
- if (conn->force_user || conn->force_group) {
- int ngroups = 0;
-
- /* groups stuff added by ih */
- conn->ngroups = 0;
- conn->groups = NULL;
-
- /* Find all the groups this uid is in and
- store them. Used by change_to_user() */
- initialise_groups(conn->user, conn->uid, conn->gid);
- get_current_groups(conn->gid, &ngroups, &conn->groups);
- conn->ngroups = ngroups;
-
- conn->nt_user_token =
- create_nt_token(conn->uid, conn->gid,
- conn->ngroups, conn->groups,
- guest);
+ TALLOC_FREE(s);
}
/*
*/
{
- BOOL can_write = share_access_check(conn, snum, vuser,
- FILE_WRITE_DATA);
+ bool can_write = False;
+
+ can_write = share_access_check(conn->server_info->ptok,
+ lp_servicename(snum),
+ FILE_WRITE_DATA);
if (!can_write) {
- if (!share_access_check(conn, snum, vuser,
+ if (!share_access_check(conn->server_info->ptok,
+ lp_servicename(snum),
FILE_READ_DATA)) {
/* No access, read or write. */
DEBUG(0,("make_connection: connection to %s "
"descriptor.\n",
lp_servicename(snum)));
conn_free(conn);
- *status = NT_STATUS_ACCESS_DENIED;
+ *pstatus = NT_STATUS_ACCESS_DENIED;
return NULL;
} else {
conn->read_only = True;
DEBUG(0, ("vfs_init failed for service %s\n",
lp_servicename(snum)));
conn_free(conn);
- *status = NT_STATUS_BAD_NETWORK_NAME;
+ *pstatus = NT_STATUS_BAD_NETWORK_NAME;
return NULL;
}
* depend on the realpath() pointer in the vfs table. JRA.
*/
if (!lp_widelinks(snum)) {
- pstring s;
- pstrcpy(s,conn->connectpath);
- canonicalize_path(conn, s);
- set_conn_connectpath(conn,s);
+ if (!canonicalize_connect_path(conn)) {
+ DEBUG(0, ("canonicalize_connect_path failed "
+ "for service %s, path %s\n",
+ lp_servicename(snum),
+ conn->connectpath));
+ conn_free(conn);
+ *pstatus = NT_STATUS_BAD_NETWORK_NAME;
+ return NULL;
+ }
+ }
+
+ if ((!conn->printer) && (!conn->ipc)) {
+ conn->notify_ctx = notify_init(conn, server_id_self(),
+ smbd_messaging_context(),
+ smbd_event_context(),
+ conn);
}
/* ROOT Activities: */
- /* check number of connections */
- if (!claim_connection(conn,
- lp_servicename(snum),
- lp_max_connections(snum),
- False,0)) {
- DEBUG(1,("too many connections - rejected\n"));
+ /*
+ * Enforce the max connections parameter.
+ */
+
+ if ((lp_max_connections(snum) > 0)
+ && (count_current_connections(lp_servicename(SNUM(conn)), True) >=
+ lp_max_connections(snum))) {
+
+ DEBUG(1, ("Max connections (%d) exceeded for %s\n",
+ lp_max_connections(snum), lp_servicename(snum)));
conn_free(conn);
- *status = NT_STATUS_INSUFFICIENT_RESOURCES;
+ *pstatus = NT_STATUS_INSUFFICIENT_RESOURCES;
+ return NULL;
+ }
+
+ /*
+ * Get us an entry in the connections db
+ */
+ if (!claim_connection(conn, lp_servicename(snum), 0)) {
+ DEBUG(1, ("Could not store connections entry\n"));
+ conn_free(conn);
+ *pstatus = NT_STATUS_INTERNAL_DB_ERROR;
return NULL;
}
* to below */
/* execute any "root preexec = " line */
if (*lp_rootpreexec(snum)) {
- pstring cmd;
- pstrcpy(cmd,lp_rootpreexec(snum));
- standard_sub_conn(conn,cmd,sizeof(cmd));
+ char *cmd = talloc_sub_advanced(talloc_tos(),
+ lp_servicename(SNUM(conn)),
+ conn->server_info->unix_name,
+ conn->connectpath,
+ conn->server_info->utok.gid,
+ conn->server_info->sanitized_username,
+ pdb_get_domain(conn->server_info->sam_account),
+ lp_rootpreexec(snum));
DEBUG(5,("cmd=%s\n",cmd));
ret = smbrun(cmd,NULL);
+ TALLOC_FREE(cmd);
if (ret != 0 && lp_rootpreexec_close(snum)) {
DEBUG(1,("root preexec gave %d - failing "
"connection\n", ret));
yield_connection(conn, lp_servicename(snum));
conn_free(conn);
- *status = NT_STATUS_ACCESS_DENIED;
+ *pstatus = NT_STATUS_ACCESS_DENIED;
return NULL;
}
}
DEBUG(0,("Can't become connected user!\n"));
yield_connection(conn, lp_servicename(snum));
conn_free(conn);
- *status = NT_STATUS_LOGON_FAILURE;
+ *pstatus = NT_STATUS_LOGON_FAILURE;
return NULL;
}
/* execute any "preexec = " line */
if (*lp_preexec(snum)) {
- pstring cmd;
- pstrcpy(cmd,lp_preexec(snum));
- standard_sub_conn(conn,cmd,sizeof(cmd));
+ char *cmd = talloc_sub_advanced(talloc_tos(),
+ lp_servicename(SNUM(conn)),
+ conn->server_info->unix_name,
+ conn->connectpath,
+ conn->server_info->utok.gid,
+ conn->server_info->sanitized_username,
+ pdb_get_domain(conn->server_info->sam_account),
+ lp_preexec(snum));
ret = smbrun(cmd,NULL);
+ TALLOC_FREE(cmd);
if (ret != 0 && lp_preexec_close(snum)) {
DEBUG(1,("preexec gave %d - failing connection\n",
ret));
- change_to_root_user();
- yield_connection(conn, lp_servicename(snum));
- conn_free(conn);
- *status = NT_STATUS_ACCESS_DENIED;
- return NULL;
+ *pstatus = NT_STATUS_ACCESS_DENIED;
+ goto err_root_exit;
}
}
set_namearray( &conn->veto_list, lp_veto_files(snum));
set_namearray( &conn->hide_list, lp_hide_files(snum));
set_namearray( &conn->veto_oplock_list, lp_veto_oplocks(snum));
+ set_namearray( &conn->aio_write_behind_list,
+ lp_aio_write_behind(snum));
}
/* Invoke VFS make connection hook - do this before the VFS_STAT call
to allow any filesystems needing user credentials to initialize
themselves. */
- if (SMB_VFS_CONNECT(conn, lp_servicename(snum), user) < 0) {
+ if (SMB_VFS_CONNECT(conn, lp_servicename(snum),
+ conn->server_info->unix_name) < 0) {
DEBUG(0,("make_connection: VFS make connection failed!\n"));
- change_to_root_user();
- yield_connection(conn, lp_servicename(snum));
- conn_free(conn);
- *status = NT_STATUS_UNSUCCESSFUL;
- return NULL;
+ *pstatus = NT_STATUS_UNSUCCESSFUL;
+ goto err_root_exit;
}
+ /* Any error exit after here needs to call the disconnect hook. */
+ on_err_call_dis_hook = true;
+
/* win2000 does not check the permissions on the directory
during the tree connect, instead relying on permission
check during individual operations. To match this behaviour
conn->connectpath, lp_servicename(snum),
strerror(errno) ));
}
- change_to_root_user();
- /* Call VFS disconnect hook */
- SMB_VFS_DISCONNECT(conn);
- yield_connection(conn, lp_servicename(snum));
- conn_free(conn);
- *status = NT_STATUS_BAD_NETWORK_NAME;
- return NULL;
+ *pstatus = NT_STATUS_BAD_NETWORK_NAME;
+ goto err_root_exit;
}
-
+
string_set(&conn->origpath,conn->connectpath);
-
+
#if SOFTLINK_OPTIMISATION
/* resolve any soft links early if possible */
if (vfs_ChDir(conn,conn->connectpath) == 0) {
- pstring s;
- pstrcpy(s,conn->connectpath);
- vfs_GetWd(conn,s);
- set_conn_connectpath(conn,s);
+ TALLOC_CTX *ctx = talloc_tos();
+ char *s = vfs_GetWd(ctx,s);
+ if (!s) {
+ *status = map_nt_error_from_unix(errno);
+ goto err_root_exit;
+ }
+ if (!set_conn_connectpath(conn,s)) {
+ *status = NT_STATUS_NO_MEMORY;
+ goto err_root_exit;
+ }
vfs_ChDir(conn,conn->connectpath);
}
#endif
-
+
+ /* Figure out the characteristics of the underlying filesystem. This
+ * assumes that all the filesystem mounted withing a share path have
+ * the same characteristics, which is likely but not guaranteed.
+ */
+
+ conn->fs_capabilities = SMB_VFS_FS_CAPABILITIES(conn);
+
/*
* Print out the 'connected as' stuff here as we need
* to know the effective uid and gid we will be using
conn->client_address );
dbgtext( "%s", srv_is_signing_active() ? "signed " : "");
dbgtext( "connect to service %s ", lp_servicename(snum) );
- dbgtext( "initially as user %s ", user );
+ dbgtext( "initially as user %s ",
+ conn->server_info->unix_name );
dbgtext( "(uid=%d, gid=%d) ", (int)geteuid(), (int)getegid() );
dbgtext( "(pid %d)\n", (int)sys_getpid() );
}
-
+
/* we've finished with the user stuff - go back to root */
change_to_root_user();
return(conn);
+
+ err_root_exit:
+
+ change_to_root_user();
+ if (on_err_call_dis_hook) {
+ /* Call VFS disconnect hook */
+ SMB_VFS_DISCONNECT(conn);
+ }
+ yield_connection(conn, lp_servicename(snum));
+ conn_free(conn);
+ return NULL;
}
/***************************************************************************************
*/
if ( conn && vfs_ChDir(conn,conn->connectpath) != 0 ) {
- DEBUG(0,("move_driver_to_download_area: Can't change "
+ DEBUG(0,("make_connection_with_chdir: Can't change "
"directory to %s for [print$] (%s)\n",
conn->connectpath,strerror(errno)));
yield_connection(conn, lp_servicename(SNUM(conn)));
fstring service;
fstring dev;
int snum = -1;
+ char addr[INET6_ADDRSTRLEN];
fstrcpy(dev, pdev);
smb_panic("make_connection: PANIC ERROR. Called as nonroot\n");
}
+ if (conn_num_open() > 2047) {
+ *status = NT_STATUS_INSUFF_SERVER_RESOURCES;
+ return NULL;
+ }
+
if(lp_security() != SEC_SHARE) {
vuser = get_valid_user_struct(vuid);
if (!vuser) {
if (strequal(service_in,HOMES_NAME)) {
if(lp_security() != SEC_SHARE) {
- DATA_BLOB no_pw = data_blob(NULL, 0);
+ DATA_BLOB no_pw = data_blob_null;
if (vuser->homes_snum == -1) {
DEBUG(2, ("[homes] share not available for "
"this user because it was not found "
} else if ((lp_security() != SEC_SHARE) && (vuser->homes_snum != -1)
&& strequal(service_in,
lp_servicename(vuser->homes_snum))) {
- DATA_BLOB no_pw = data_blob(NULL, 0);
+ DATA_BLOB no_pw = data_blob_null;
DEBUG(5, ("making a connection to 'homes' service [%s] "
"created at session setup time\n", service_in));
return make_connection_snum(vuser->homes_snum,
}
DEBUG(0,("%s (%s) couldn't find service %s\n",
- get_remote_machine_name(), client_addr(), service));
+ get_remote_machine_name(),
+ client_addr(get_client_fd(),addr,sizeof(addr)),
+ service));
*status = NT_STATUS_BAD_NETWORK_NAME;
return NULL;
}
void close_cnum(connection_struct *conn, uint16 vuid)
{
- if (IS_IPC(conn)) {
- pipe_close_conn(conn);
- } else {
- file_close_conn(conn);
+ file_close_conn(conn);
+
+ if (!IS_IPC(conn)) {
dptr_closecnum(conn);
}
/* execute any "postexec = " line */
if (*lp_postexec(SNUM(conn)) &&
change_to_user(conn, vuid)) {
- pstring cmd;
- pstrcpy(cmd,lp_postexec(SNUM(conn)));
- standard_sub_conn(conn,cmd,sizeof(cmd));
+ char *cmd = talloc_sub_advanced(talloc_tos(),
+ lp_servicename(SNUM(conn)),
+ conn->server_info->unix_name,
+ conn->connectpath,
+ conn->server_info->utok.gid,
+ conn->server_info->sanitized_username,
+ pdb_get_domain(conn->server_info->sam_account),
+ lp_postexec(SNUM(conn)));
smbrun(cmd,NULL);
+ TALLOC_FREE(cmd);
change_to_root_user();
}
change_to_root_user();
/* execute any "root postexec = " line */
if (*lp_rootpostexec(SNUM(conn))) {
- pstring cmd;
- pstrcpy(cmd,lp_rootpostexec(SNUM(conn)));
- standard_sub_conn(conn,cmd,sizeof(cmd));
+ char *cmd = talloc_sub_advanced(talloc_tos(),
+ lp_servicename(SNUM(conn)),
+ conn->server_info->unix_name,
+ conn->connectpath,
+ conn->server_info->utok.gid,
+ conn->server_info->sanitized_username,
+ pdb_get_domain(conn->server_info->sam_account),
+ lp_rootpostexec(SNUM(conn)));
smbrun(cmd,NULL);
+ TALLOC_FREE(cmd);
}
conn_free(conn);
git.samba.org / samba.git / blobdiff