source3/smbd/msdfs.c

   1 /*
   2    Unix SMB/Netbios implementation.
   3    Version 3.0
   4    MSDFS services for Samba
   5    Copyright (C) Shirish Kalele 2000
   6    Copyright (C) Jeremy Allison 2007
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20
  21 */
  22
  23 #define DBGC_CLASS DBGC_MSDFS
  24 #include "includes.h"
  25 #include "system/filesys.h"
  26 #include "smbd/smbd.h"
  27 #include "smbd/globals.h"
  28 #include "msdfs.h"
  29 #include "auth.h"
  30 #include "lib/param/loadparm.h"
  31 #include "libcli/security/security.h"
  32 #include "librpc/gen_ndr/ndr_dfsblobs.h"
  33
  34 /**********************************************************************
  35  Parse a DFS pathname of the form \hostname\service\reqpath
  36  into the dfs_path structure.
  37  If POSIX pathnames is true, the pathname may also be of the
  38  form /hostname/service/reqpath.
  39  We cope with either here.
  40
  41  Unfortunately, due to broken clients who might set the
  42  SVAL(inbuf,smb_flg2) & FLAGS2_DFS_PATHNAMES bit and then
  43  send a local path, we have to cope with that too....
  44
  45  If conn != NULL then ensure the provided service is
  46  the one pointed to by the connection.
  47
  48  This version does everything using pointers within one copy of the
  49  pathname string, talloced on the struct dfs_path pointer (which
  50  must be talloced). This may be too clever to live....
  51  JRA.
  52 **********************************************************************/
  53
  54 static NTSTATUS parse_dfs_path(connection_struct *conn,
  55                                 const char *pathname,
  56                                 bool allow_wcards,
  57                                 bool allow_broken_path,
  58                                 struct dfs_path *pdp, /* MUST BE TALLOCED */
  59                                 bool *ppath_contains_wcard)
  60 {
  61         char *pathname_local;
  62         char *p,*temp;
  63         char *servicename;
  64         char *eos_ptr;
  65         NTSTATUS status = NT_STATUS_OK;
  66         char sepchar;
  67
  68         ZERO_STRUCTP(pdp);
  69
  70         /*
  71          * This is the only talloc we should need to do
  72          * on the struct dfs_path. All the pointers inside
  73          * it should point to offsets within this string.
  74          */
  75
  76         pathname_local = talloc_strdup(pdp, pathname);
  77         if (!pathname_local) {
  78                 return NT_STATUS_NO_MEMORY;
  79         }
  80         /* Get a pointer to the terminating '\0' */
  81         eos_ptr = &pathname_local[strlen(pathname_local)];
  82         p = temp = pathname_local;
  83
  84         pdp->posix_path = (lp_posix_pathnames() && *pathname == '/');
  85
  86         sepchar = pdp->posix_path ? '/' : '\\';
  87
  88         if (allow_broken_path && (*pathname != sepchar)) {
  89                 DEBUG(10,("parse_dfs_path: path %s doesn't start with %c\n",
  90                         pathname, sepchar ));
  91                 /*
  92                  * Possibly client sent a local path by mistake.
  93                  * Try and convert to a local path.
  94                  */
  95
  96                 pdp->hostname = eos_ptr; /* "" */
  97                 pdp->servicename = eos_ptr; /* "" */
  98
  99                 /* We've got no info about separators. */
 100                 pdp->posix_path = lp_posix_pathnames();
 101                 p = temp;
 102                 DEBUG(10,("parse_dfs_path: trying to convert %s to a "
 103                         "local path\n",
 104                         temp));
 105                 goto local_path;
 106         }
 107
 108         /*
 109          * Safe to use on talloc'ed string as it only shrinks.
 110          * It also doesn't affect the eos_ptr.
 111          */
 112         trim_char(temp,sepchar,sepchar);
 113
 114         DEBUG(10,("parse_dfs_path: temp = |%s| after trimming %c's\n",
 115                 temp, sepchar));
 116
 117         /* Now tokenize. */
 118         /* Parse out hostname. */
 119         p = strchr_m(temp,sepchar);
 120         if(p == NULL) {
 121                 DEBUG(10,("parse_dfs_path: can't parse hostname from path %s\n",
 122                         temp));
 123                 /*
 124                  * Possibly client sent a local path by mistake.
 125                  * Try and convert to a local path.
 126                  */
 127
 128                 pdp->hostname = eos_ptr; /* "" */
 129                 pdp->servicename = eos_ptr; /* "" */
 130
 131                 p = temp;
 132                 DEBUG(10,("parse_dfs_path: trying to convert %s "
 133                         "to a local path\n",
 134                         temp));
 135                 goto local_path;
 136         }
 137         *p = '\0';
 138         pdp->hostname = temp;
 139
 140         DEBUG(10,("parse_dfs_path: hostname: %s\n",pdp->hostname));
 141
 142         /* Parse out servicename. */
 143         servicename = p+1;
 144         p = strchr_m(servicename,sepchar);
 145         if (p) {
 146                 *p = '\0';
 147         }
 148
 149         /* Is this really our servicename ? */
 150         if (conn && !( strequal(servicename, lp_servicename(talloc_tos(), SNUM(conn)))
 151                         || (strequal(servicename, HOMES_NAME)
 152                         && strequal(lp_servicename(talloc_tos(), SNUM(conn)),
 153                                 get_current_username()) )) ) {
 154                 DEBUG(10,("parse_dfs_path: %s is not our servicename\n",
 155                         servicename));
 156
 157                 /*
 158                  * Possibly client sent a local path by mistake.
 159                  * Try and convert to a local path.
 160                  */
 161
 162                 pdp->hostname = eos_ptr; /* "" */
 163                 pdp->servicename = eos_ptr; /* "" */
 164
 165                 /* Repair the path - replace the sepchar's
 166                    we nulled out */
 167                 servicename--;
 168                 *servicename = sepchar;
 169                 if (p) {
 170                         *p = sepchar;
 171                 }
 172
 173                 p = temp;
 174                 DEBUG(10,("parse_dfs_path: trying to convert %s "
 175                         "to a local path\n",
 176                         temp));
 177                 goto local_path;
 178         }
 179
 180         pdp->servicename = servicename;
 181
 182         DEBUG(10,("parse_dfs_path: servicename: %s\n",pdp->servicename));
 183
 184         if(p == NULL) {
 185                 /* Client sent self referral \server\share. */
 186                 pdp->reqpath = eos_ptr; /* "" */
 187                 return NT_STATUS_OK;
 188         }
 189
 190         p++;
 191
 192   local_path:
 193
 194         *ppath_contains_wcard = False;
 195
 196         pdp->reqpath = p;
 197
 198         /* Rest is reqpath. */
 199         if (pdp->posix_path) {
 200                 status = check_path_syntax_posix(pdp->reqpath);
 201         } else {
 202                 if (allow_wcards) {
 203                         status = check_path_syntax_wcard(pdp->reqpath,
 204                                         ppath_contains_wcard);
 205                 } else {
 206                         status = check_path_syntax(pdp->reqpath);
 207                 }
 208         }
 209
 210         if (!NT_STATUS_IS_OK(status)) {
 211                 DEBUG(10,("parse_dfs_path: '%s' failed with %s\n",
 212                         p, nt_errstr(status) ));
 213                 return status;
 214         }
 215
 216         DEBUG(10,("parse_dfs_path: rest of the path: %s\n",pdp->reqpath));
 217         return NT_STATUS_OK;
 218 }
 219
 220 /********************************************************
 221  Fake up a connection struct for the VFS layer, for use in
 222  applications (such as the python bindings), that do not want the
 223  global working directory changed under them.
 224 *********************************************************/
 225
 226 NTSTATUS create_conn_struct(TALLOC_CTX *ctx,
 227                             struct tevent_context *ev,
 228                             struct messaging_context *msg,
 229                             connection_struct **pconn,
 230                             int snum,
 231                             const char *path,
 232                             const struct auth_session_info *session_info)
 233 {
 234         connection_struct *conn;
 235         char *connpath;
 236         const char *vfs_user;
 237         struct smbd_server_connection *sconn;
 238         const char *servicename = lp_const_servicename(snum);
 239
 240         sconn = talloc_zero(ctx, struct smbd_server_connection);
 241         if (sconn == NULL) {
 242                 return NT_STATUS_NO_MEMORY;
 243         }
 244
 245         sconn->ev_ctx = ev;
 246         sconn->msg_ctx = msg;
 247         sconn->sock = -1;
 248         sconn->smb1.echo_handler.trusted_fd = -1;
 249         sconn->smb1.echo_handler.socket_lock_fd = -1;
 250
 251         conn = conn_new(sconn);
 252         if (conn == NULL) {
 253                 TALLOC_FREE(sconn);
 254                 return NT_STATUS_NO_MEMORY;
 255         }
 256
 257         /* Now we have conn, we need to make sconn a child of conn,
 258          * for a proper talloc tree */
 259         talloc_steal(conn, sconn);
 260
 261         if (snum == -1 && servicename == NULL) {
 262                 servicename = "Unknown Service (snum == -1)";
 263         }
 264
 265         connpath = talloc_strdup(conn, path);
 266         if (!connpath) {
 267                 TALLOC_FREE(conn);
 268                 return NT_STATUS_NO_MEMORY;
 269         }
 270         connpath = talloc_string_sub(conn,
 271                                      connpath,
 272                                      "%S",
 273                                      servicename);
 274         if (!connpath) {
 275                 TALLOC_FREE(conn);
 276                 return NT_STATUS_NO_MEMORY;
 277         }
 278
 279         /* needed for smbd_vfs_init() */
 280
 281         conn->params->service = snum;
 282         conn->cnum = TID_FIELD_INVALID;
 283
 284         if (session_info != NULL) {
 285                 conn->session_info = copy_session_info(conn, session_info);
 286                 if (conn->session_info == NULL) {
 287                         DEBUG(0, ("copy_serverinfo failed\n"));
 288                         TALLOC_FREE(conn);
 289                         return NT_STATUS_NO_MEMORY;
 290                 }
 291                 vfs_user = conn->session_info->unix_info->unix_name;
 292         } else {
 293                 /* use current authenticated user in absence of session_info */
 294                 vfs_user = get_current_username();
 295         }
 296
 297         set_conn_connectpath(conn, connpath);
 298
 299         /*
 300          * New code to check if there's a share security descripter
 301          * added from NT server manager. This is done after the
 302          * smb.conf checks are done as we need a uid and token. JRA.
 303          *
 304          */
 305         if (conn->session_info) {
 306                 share_access_check(conn->session_info->security_token,
 307                                    servicename,
 308                                    MAXIMUM_ALLOWED_ACCESS,
 309                                    &conn->share_access);
 310
 311                 if ((conn->share_access & FILE_WRITE_DATA) == 0) {
 312                         if ((conn->share_access & FILE_READ_DATA) == 0) {
 313                                 /* No access, read or write. */
 314                                 DEBUG(0,("create_conn_struct: connection to %s "
 315                                          "denied due to security "
 316                                          "descriptor.\n",
 317                                          servicename));
 318                                 conn_free(conn);
 319                                 return NT_STATUS_ACCESS_DENIED;
 320                         } else {
 321                                 conn->read_only = true;
 322                         }
 323                 }
 324         } else {
 325                 conn->share_access = 0;
 326                 conn->read_only = true;
 327         }
 328
 329         if (!smbd_vfs_init(conn)) {
 330                 NTSTATUS status = map_nt_error_from_unix(errno);
 331                 DEBUG(0,("create_conn_struct: smbd_vfs_init failed.\n"));
 332                 conn_free(conn);
 333                 return status;
 334         }
 335
 336         /* this must be the first filesystem operation that we do */
 337         if (SMB_VFS_CONNECT(conn, servicename, vfs_user) < 0) {
 338                 DEBUG(0,("VFS connect failed!\n"));
 339                 conn_free(conn);
 340                 return NT_STATUS_UNSUCCESSFUL;
 341         }
 342
 343         conn->fs_capabilities = SMB_VFS_FS_CAPABILITIES(conn, &conn->ts_res);
 344         *pconn = conn;
 345
 346         return NT_STATUS_OK;
 347 }
 348
 349 /********************************************************
 350  Fake up a connection struct for the VFS layer.
 351  Note: this performs a vfs connect and CHANGES CWD !!!! JRA.
 352
 353  The old working directory is returned on *poldcwd, allocated on ctx.
 354 *********************************************************/
 355
 356 NTSTATUS create_conn_struct_cwd(TALLOC_CTX *ctx,
 357                                 struct tevent_context *ev,
 358                                 struct messaging_context *msg,
 359                                 connection_struct **pconn,
 360                                 int snum,
 361                                 const char *path,
 362                                 const struct auth_session_info *session_info,
 363                                 char **poldcwd)
 364 {
 365         connection_struct *conn;
 366         char *oldcwd;
 367
 368         NTSTATUS status = create_conn_struct(ctx, ev,
 369                                              msg, &conn,
 370                                              snum, path,
 371                                              session_info);
 372         if (!NT_STATUS_IS_OK(status)) {
 373                 return status;
 374         }
 375
 376         /*
 377          * Windows seems to insist on doing trans2getdfsreferral() calls on
 378          * the IPC$ share as the anonymous user. If we try to chdir as that
 379          * user we will fail.... WTF ? JRA.
 380          */
 381
 382         oldcwd = vfs_GetWd(ctx, conn);
 383         if (oldcwd == NULL) {
 384                 status = map_nt_error_from_unix(errno);
 385                 DEBUG(3, ("vfs_GetWd failed: %s\n", strerror(errno)));
 386                 conn_free(conn);
 387                 return status;
 388         }
 389
 390         if (vfs_ChDir(conn,conn->connectpath) != 0) {
 391                 status = map_nt_error_from_unix(errno);
 392                 DEBUG(3,("create_conn_struct: Can't ChDir to new conn path %s. "
 393                         "Error was %s\n",
 394                         conn->connectpath, strerror(errno) ));
 395                 conn_free(conn);
 396                 return status;
 397         }
 398
 399         *pconn = conn;
 400         *poldcwd = oldcwd;
 401
 402         return NT_STATUS_OK;
 403 }
 404
 405 /**********************************************************************
 406  Parse the contents of a symlink to verify if it is an msdfs referral
 407  A valid referral is of the form:
 408
 409  msdfs:server1\share1,server2\share2
 410  msdfs:server1\share1\pathname,server2\share2\pathname
 411  msdfs:server1/share1,server2/share2
 412  msdfs:server1/share1/pathname,server2/share2/pathname.
 413
 414  Note that the alternate paths returned here must be of the canonicalized
 415  form:
 416
 417  \server\share or
 418  \server\share\path\to\file,
 419
 420  even in posix path mode. This is because we have no knowledge if the
 421  server we're referring to understands posix paths.
 422  **********************************************************************/
 423
 424 static bool parse_msdfs_symlink(TALLOC_CTX *ctx,
 425                                 const char *target,
 426                                 struct referral **preflist,
 427                                 int *refcount)
 428 {
 429         char *temp = NULL;
 430         char *prot;
 431         char **alt_path = NULL;
 432         int count = 0, i;
 433         struct referral *reflist;
 434         char *saveptr;
 435
 436         temp = talloc_strdup(ctx, target);
 437         if (!temp) {
 438                 return False;
 439         }
 440         prot = strtok_r(temp, ":", &saveptr);
 441         if (!prot) {
 442                 DEBUG(0,("parse_msdfs_symlink: invalid path !\n"));
 443                 return False;
 444         }
 445
 446         alt_path = talloc_array(ctx, char *, MAX_REFERRAL_COUNT);
 447         if (!alt_path) {
 448                 return False;
 449         }
 450
 451         /* parse out the alternate paths */
 452         while((count<MAX_REFERRAL_COUNT) &&
 453               ((alt_path[count] = strtok_r(NULL, ",", &saveptr)) != NULL)) {
 454                 count++;
 455         }
 456
 457         DEBUG(10,("parse_msdfs_symlink: count=%d\n", count));
 458
 459         if (count) {
 460                 reflist = *preflist = talloc_zero_array(ctx,
 461                                 struct referral, count);
 462                 if(reflist == NULL) {
 463                         TALLOC_FREE(alt_path);
 464                         return False;
 465                 }
 466         } else {
 467                 reflist = *preflist = NULL;
 468         }
 469
 470         for(i=0;i<count;i++) {
 471                 char *p;
 472
 473                 /* Canonicalize link target.
 474                  * Replace all /'s in the path by a \ */
 475                 string_replace(alt_path[i], '/', '\\');
 476
 477                 /* Remove leading '\\'s */
 478                 p = alt_path[i];
 479                 while (*p && (*p == '\\')) {
 480                         p++;
 481                 }
 482
 483                 reflist[i].alternate_path = talloc_asprintf(ctx,
 484                                 "\\%s",
 485                                 p);
 486                 if (!reflist[i].alternate_path) {
 487                         return False;
 488                 }
 489
 490                 reflist[i].proximity = 0;
 491                 reflist[i].ttl = REFERRAL_TTL;
 492                 DEBUG(10, ("parse_msdfs_symlink: Created alt path: %s\n",
 493                                         reflist[i].alternate_path));
 494         }
 495
 496         *refcount = count;
 497
 498         TALLOC_FREE(alt_path);
 499         return True;
 500 }
 501
 502 /**********************************************************************
 503  Returns true if the unix path is a valid msdfs symlink and also
 504  returns the target string from inside the link.
 505 **********************************************************************/
 506
 507 static bool is_msdfs_link_internal(TALLOC_CTX *ctx,
 508                         connection_struct *conn,
 509                         const char *path,
 510                         char **pp_link_target,
 511                         SMB_STRUCT_STAT *sbufp)
 512 {
 513         int referral_len = 0;
 514 #if defined(HAVE_BROKEN_READLINK)
 515         char link_target_buf[PATH_MAX];
 516 #else
 517         char link_target_buf[7];
 518 #endif
 519         size_t bufsize = 0;
 520         char *link_target = NULL;
 521         struct smb_filename smb_fname;
 522
 523         if (pp_link_target) {
 524                 bufsize = 1024;
 525                 link_target = talloc_array(ctx, char, bufsize);
 526                 if (!link_target) {
 527                         return False;
 528                 }
 529                 *pp_link_target = link_target;
 530         } else {
 531                 bufsize = sizeof(link_target_buf);
 532                 link_target = link_target_buf;
 533         }
 534
 535         ZERO_STRUCT(smb_fname);
 536         smb_fname.base_name = discard_const_p(char, path);
 537
 538         if (SMB_VFS_LSTAT(conn, &smb_fname) != 0) {
 539                 DEBUG(5,("is_msdfs_link_read_target: %s does not exist.\n",
 540                         path));
 541                 goto err;
 542         }
 543         if (!S_ISLNK(smb_fname.st.st_ex_mode)) {
 544                 DEBUG(5,("is_msdfs_link_read_target: %s is not a link.\n",
 545                                         path));
 546                 goto err;
 547         }
 548         if (sbufp != NULL) {
 549                 *sbufp = smb_fname.st;
 550         }
 551
 552         referral_len = SMB_VFS_READLINK(conn, path, link_target, bufsize - 1);
 553         if (referral_len == -1) {
 554                 DEBUG(0,("is_msdfs_link_read_target: Error reading "
 555                         "msdfs link %s: %s\n",
 556                         path, strerror(errno)));
 557                 goto err;
 558         }
 559         link_target[referral_len] = '\0';
 560
 561         DEBUG(5,("is_msdfs_link_internal: %s -> %s\n",path,
 562                                 link_target));
 563
 564         if (!strnequal(link_target, "msdfs:", 6)) {
 565                 goto err;
 566         }
 567         return True;
 568
 569   err:
 570
 571         if (link_target != link_target_buf) {
 572                 TALLOC_FREE(link_target);
 573         }
 574         return False;
 575 }
 576
 577 /**********************************************************************
 578  Returns true if the unix path is a valid msdfs symlink.
 579 **********************************************************************/
 580
 581 bool is_msdfs_link(connection_struct *conn,
 582                 const char *path,
 583                 SMB_STRUCT_STAT *sbufp)
 584 {
 585         return is_msdfs_link_internal(talloc_tos(),
 586                                         conn,
 587                                         path,
 588                                         NULL,
 589                                         sbufp);
 590 }
 591
 592 /*****************************************************************
 593  Used by other functions to decide if a dfs path is remote,
 594  and to get the list of referred locations for that remote path.
 595
 596  search_flag: For findfirsts, dfs links themselves are not
 597  redirected, but paths beyond the links are. For normal smb calls,
 598  even dfs links need to be redirected.
 599
 600  consumedcntp: how much of the dfs path is being redirected. the client
 601  should try the remaining path on the redirected server.
 602
 603  If this returns NT_STATUS_PATH_NOT_COVERED the contents of the msdfs
 604  link redirect are in targetpath.
 605 *****************************************************************/
 606
 607 static NTSTATUS dfs_path_lookup(TALLOC_CTX *ctx,
 608                 connection_struct *conn,
 609                 const char *dfspath, /* Incoming complete dfs path */
 610                 const struct dfs_path *pdp, /* Parsed out
 611                                                server+share+extrapath. */
 612                 bool search_flag, /* Called from a findfirst ? */
 613                 int *consumedcntp,
 614                 char **pp_targetpath)
 615 {
 616         char *p = NULL;
 617         char *q = NULL;
 618         NTSTATUS status;
 619         struct smb_filename *smb_fname = NULL;
 620         char *canon_dfspath = NULL; /* Canonicalized dfs path. (only '/'
 621                                   components). */
 622
 623         DEBUG(10,("dfs_path_lookup: Conn path = %s reqpath = %s\n",
 624                 conn->connectpath, pdp->reqpath));
 625
 626         /*
 627          * Note the unix path conversion here we're doing we
 628          * throw away. We're looking for a symlink for a dfs
 629          * resolution, if we don't find it we'll do another
 630          * unix_convert later in the codepath.
 631          */
 632
 633         status = unix_convert(ctx, conn, pdp->reqpath, &smb_fname,
 634                               search_flag ? UCF_ALWAYS_ALLOW_WCARD_LCOMP : 0);
 635
 636         if (!NT_STATUS_IS_OK(status)) {
 637                 if (!NT_STATUS_EQUAL(status,
 638                                      NT_STATUS_OBJECT_PATH_NOT_FOUND)) {
 639                         return status;
 640                 }
 641                 if (smb_fname == NULL || smb_fname->base_name == NULL) {
 642                         return status;
 643                 }
 644         }
 645
 646         /* Optimization - check if we can redirect the whole path. */
 647
 648         if (is_msdfs_link_internal(ctx, conn, smb_fname->base_name,
 649                                    pp_targetpath, NULL)) {
 650                 if (search_flag) {
 651                         DEBUG(6,("dfs_path_lookup (FindFirst) No redirection "
 652                                  "for dfs link %s.\n", dfspath));
 653                         status = NT_STATUS_OK;
 654                         goto out;
 655                 }
 656
 657                 DEBUG(6,("dfs_path_lookup: %s resolves to a "
 658                         "valid dfs link %s.\n", dfspath,
 659                         pp_targetpath ? *pp_targetpath : ""));
 660
 661                 if (consumedcntp) {
 662                         *consumedcntp = strlen(dfspath);
 663                 }
 664                 status = NT_STATUS_PATH_NOT_COVERED;
 665                 goto out;
 666         }
 667
 668         /* Prepare to test only for '/' components in the given path,
 669          * so if a Windows path replace all '\\' characters with '/'.
 670          * For a POSIX DFS path we know all separators are already '/'. */
 671
 672         canon_dfspath = talloc_strdup(ctx, dfspath);
 673         if (!canon_dfspath) {
 674                 status = NT_STATUS_NO_MEMORY;
 675                 goto out;
 676         }
 677         if (!pdp->posix_path) {
 678                 string_replace(canon_dfspath, '\\', '/');
 679         }
 680
 681         /*
 682          * localpath comes out of unix_convert, so it has
 683          * no trailing backslash. Make sure that canon_dfspath hasn't either.
 684          * Fix for bug #4860 from Jan Martin <Jan.Martin@rwedea.com>.
 685          */
 686
 687         trim_char(canon_dfspath,0,'/');
 688
 689         /*
 690          * Redirect if any component in the path is a link.
 691          * We do this by walking backwards through the
 692          * local path, chopping off the last component
 693          * in both the local path and the canonicalized
 694          * DFS path. If we hit a DFS link then we're done.
 695          */
 696
 697         p = strrchr_m(smb_fname->base_name, '/');
 698         if (consumedcntp) {
 699                 q = strrchr_m(canon_dfspath, '/');
 700         }
 701
 702         while (p) {
 703                 *p = '\0';
 704                 if (q) {
 705                         *q = '\0';
 706                 }
 707
 708                 if (is_msdfs_link_internal(ctx, conn,
 709                                            smb_fname->base_name, pp_targetpath,
 710                                            NULL)) {
 711                         DEBUG(4, ("dfs_path_lookup: Redirecting %s because "
 712                                   "parent %s is dfs link\n", dfspath,
 713                                   smb_fname_str_dbg(smb_fname)));
 714
 715                         if (consumedcntp) {
 716                                 *consumedcntp = strlen(canon_dfspath);
 717                                 DEBUG(10, ("dfs_path_lookup: Path consumed: %s "
 718                                         "(%d)\n",
 719                                         canon_dfspath,
 720                                         *consumedcntp));
 721                         }
 722
 723                         status = NT_STATUS_PATH_NOT_COVERED;
 724                         goto out;
 725                 }
 726
 727                 /* Step back on the filesystem. */
 728                 p = strrchr_m(smb_fname->base_name, '/');
 729
 730                 if (consumedcntp) {
 731                         /* And in the canonicalized dfs path. */
 732                         q = strrchr_m(canon_dfspath, '/');
 733                 }
 734         }
 735
 736         status = NT_STATUS_OK;
 737  out:
 738         TALLOC_FREE(smb_fname);
 739         return status;
 740 }
 741
 742 /*****************************************************************
 743  Decides if a dfs pathname should be redirected or not.
 744  If not, the pathname is converted to a tcon-relative local unix path
 745
 746  search_wcard_flag: this flag performs 2 functions both related
 747  to searches.  See resolve_dfs_path() and parse_dfs_path_XX()
 748  for details.
 749
 750  This function can return NT_STATUS_OK, meaning use the returned path as-is
 751  (mapped into a local path).
 752  or NT_STATUS_NOT_COVERED meaning return a DFS redirect, or
 753  any other NT_STATUS error which is a genuine error to be
 754  returned to the client.
 755 *****************************************************************/
 756
 757 static NTSTATUS dfs_redirect(TALLOC_CTX *ctx,
 758                         connection_struct *conn,
 759                         const char *path_in,
 760                         bool search_wcard_flag,
 761                         bool allow_broken_path,
 762                         char **pp_path_out,
 763                         bool *ppath_contains_wcard)
 764 {
 765         NTSTATUS status;
 766         struct dfs_path *pdp = talloc(ctx, struct dfs_path);
 767
 768         if (!pdp) {
 769                 return NT_STATUS_NO_MEMORY;
 770         }
 771
 772         status = parse_dfs_path(conn, path_in, search_wcard_flag,
 773                                 allow_broken_path, pdp,
 774                         ppath_contains_wcard);
 775         if (!NT_STATUS_IS_OK(status)) {
 776                 TALLOC_FREE(pdp);
 777                 return status;
 778         }
 779
 780         if (pdp->reqpath[0] == '\0') {
 781                 TALLOC_FREE(pdp);
 782                 *pp_path_out = talloc_strdup(ctx, "");
 783                 if (!*pp_path_out) {
 784                         return NT_STATUS_NO_MEMORY;
 785                 }
 786                 DEBUG(5,("dfs_redirect: self-referral.\n"));
 787                 return NT_STATUS_OK;
 788         }
 789
 790         /* If dfs pathname for a non-dfs share, convert to tcon-relative
 791            path and return OK */
 792
 793         if (!lp_msdfs_root(SNUM(conn))) {
 794                 *pp_path_out = talloc_strdup(ctx, pdp->reqpath);
 795                 TALLOC_FREE(pdp);
 796                 if (!*pp_path_out) {
 797                         return NT_STATUS_NO_MEMORY;
 798                 }
 799                 return NT_STATUS_OK;
 800         }
 801
 802         /* If it looked like a local path (zero hostname/servicename)
 803          * just treat as a tcon-relative path. */
 804
 805         if (pdp->hostname[0] == '\0' && pdp->servicename[0] == '\0') {
 806                 *pp_path_out = talloc_strdup(ctx, pdp->reqpath);
 807                 TALLOC_FREE(pdp);
 808                 if (!*pp_path_out) {
 809                         return NT_STATUS_NO_MEMORY;
 810                 }
 811                 return NT_STATUS_OK;
 812         }
 813
 814         if (!( strequal(pdp->servicename, lp_servicename(talloc_tos(), SNUM(conn)))
 815                         || (strequal(pdp->servicename, HOMES_NAME)
 816                         && strequal(lp_servicename(talloc_tos(), SNUM(conn)),
 817                                 conn->session_info->unix_info->sanitized_username) )) ) {
 818
 819                 /* The given sharename doesn't match this connection. */
 820                 TALLOC_FREE(pdp);
 821
 822                 return NT_STATUS_OBJECT_PATH_NOT_FOUND;
 823         }
 824
 825         status = dfs_path_lookup(ctx, conn, path_in, pdp,
 826                         search_wcard_flag, NULL, NULL);
 827         if (!NT_STATUS_IS_OK(status)) {
 828                 if (NT_STATUS_EQUAL(status, NT_STATUS_PATH_NOT_COVERED)) {
 829                         DEBUG(3,("dfs_redirect: Redirecting %s\n", path_in));
 830                 } else {
 831                         DEBUG(10,("dfs_redirect: dfs_path_lookup "
 832                                 "failed for %s with %s\n",
 833                                 path_in, nt_errstr(status) ));
 834                 }
 835                 return status;
 836         }
 837
 838         DEBUG(3,("dfs_redirect: Not redirecting %s.\n", path_in));
 839
 840         /* Form non-dfs tcon-relative path */
 841         *pp_path_out = talloc_strdup(ctx, pdp->reqpath);
 842         TALLOC_FREE(pdp);
 843         if (!*pp_path_out) {
 844                 return NT_STATUS_NO_MEMORY;
 845         }
 846
 847         DEBUG(3,("dfs_redirect: Path %s converted to non-dfs path %s\n",
 848                                 path_in,
 849                                 *pp_path_out));
 850
 851         return NT_STATUS_OK;
 852 }
 853
 854 /**********************************************************************
 855  Return a self referral.
 856 **********************************************************************/
 857
 858 static NTSTATUS self_ref(TALLOC_CTX *ctx,
 859                         const char *dfs_path,
 860                         struct junction_map *jucn,
 861                         int *consumedcntp,
 862                         bool *self_referralp)
 863 {
 864         struct referral *ref;
 865
 866         *self_referralp = True;
 867
 868         jucn->referral_count = 1;
 869         if((ref = talloc_zero(ctx, struct referral)) == NULL) {
 870                 return NT_STATUS_NO_MEMORY;
 871         }
 872
 873         ref->alternate_path = talloc_strdup(ctx, dfs_path);
 874         if (!ref->alternate_path) {
 875                 TALLOC_FREE(ref);
 876                 return NT_STATUS_NO_MEMORY;
 877         }
 878         ref->proximity = 0;
 879         ref->ttl = REFERRAL_TTL;
 880         jucn->referral_list = ref;
 881         *consumedcntp = strlen(dfs_path);
 882         return NT_STATUS_OK;
 883 }
 884
 885 /**********************************************************************
 886  Gets valid referrals for a dfs path and fills up the
 887  junction_map structure.
 888 **********************************************************************/
 889
 890 NTSTATUS get_referred_path(TALLOC_CTX *ctx,
 891                         const char *dfs_path,
 892                         bool allow_broken_path,
 893                         struct junction_map *jucn,
 894                         int *consumedcntp,
 895                         bool *self_referralp)
 896 {
 897         struct connection_struct *conn;
 898         char *targetpath = NULL;
 899         int snum;
 900         NTSTATUS status = NT_STATUS_NOT_FOUND;
 901         bool dummy;
 902         struct dfs_path *pdp = talloc(ctx, struct dfs_path);
 903         char *oldpath;
 904
 905         if (!pdp) {
 906                 return NT_STATUS_NO_MEMORY;
 907         }
 908
 909         *self_referralp = False;
 910
 911         status = parse_dfs_path(NULL, dfs_path, False, allow_broken_path,
 912                                 pdp, &dummy);
 913         if (!NT_STATUS_IS_OK(status)) {
 914                 return status;
 915         }
 916
 917         jucn->service_name = talloc_strdup(ctx, pdp->servicename);
 918         jucn->volume_name = talloc_strdup(ctx, pdp->reqpath);
 919         if (!jucn->service_name || !jucn->volume_name) {
 920                 TALLOC_FREE(pdp);
 921                 return NT_STATUS_NO_MEMORY;
 922         }
 923
 924         /* Verify the share is a dfs root */
 925         snum = lp_servicenumber(jucn->service_name);
 926         if(snum < 0) {
 927                 char *service_name = NULL;
 928                 if ((snum = find_service(ctx, jucn->service_name, &service_name)) < 0) {
 929                         return NT_STATUS_NOT_FOUND;
 930                 }
 931                 if (!service_name) {
 932                         return NT_STATUS_NO_MEMORY;
 933                 }
 934                 TALLOC_FREE(jucn->service_name);
 935                 jucn->service_name = talloc_strdup(ctx, service_name);
 936                 if (!jucn->service_name) {
 937                         TALLOC_FREE(pdp);
 938                         return NT_STATUS_NO_MEMORY;
 939                 }
 940         }
 941
 942         if (!lp_msdfs_root(snum) && (*lp_msdfs_proxy(talloc_tos(), snum) == '\0')) {
 943                 DEBUG(3,("get_referred_path: |%s| in dfs path %s is not "
 944                         "a dfs root.\n",
 945                         pdp->servicename, dfs_path));
 946                 TALLOC_FREE(pdp);
 947                 return NT_STATUS_NOT_FOUND;
 948         }
 949
 950         /*
 951          * Self referrals are tested with a anonymous IPC connection and
 952          * a GET_DFS_REFERRAL call to \\server\share. (which means
 953          * dp.reqpath[0] points to an empty string). create_conn_struct cd's
 954          * into the directory and will fail if it cannot (as the anonymous
 955          * user). Cope with this.
 956          */
 957
 958         if (pdp->reqpath[0] == '\0') {
 959                 char *tmp;
 960                 struct referral *ref;
 961
 962                 if (*lp_msdfs_proxy(talloc_tos(), snum) == '\0') {
 963                         TALLOC_FREE(pdp);
 964                         return self_ref(ctx,
 965                                         dfs_path,
 966                                         jucn,
 967                                         consumedcntp,
 968                                         self_referralp);
 969                 }
 970
 971                 /*
 972                  * It's an msdfs proxy share. Redirect to
 973                  * the configured target share.
 974                  */
 975
 976                 jucn->referral_count = 1;
 977                 if ((ref = talloc_zero(ctx, struct referral)) == NULL) {
 978                         TALLOC_FREE(pdp);
 979                         return NT_STATUS_NO_MEMORY;
 980                 }
 981
 982                 if (!(tmp = talloc_strdup(ctx, lp_msdfs_proxy(talloc_tos(), snum)))) {
 983                         TALLOC_FREE(pdp);
 984                         return NT_STATUS_NO_MEMORY;
 985                 }
 986
 987                 trim_string(tmp, "\\", 0);
 988
 989                 ref->alternate_path = talloc_asprintf(ctx, "\\%s", tmp);
 990                 TALLOC_FREE(tmp);
 991
 992                 if (!ref->alternate_path) {
 993                         TALLOC_FREE(pdp);
 994                         return NT_STATUS_NO_MEMORY;
 995                 }
 996
 997                 if (pdp->reqpath[0] != '\0') {
 998                         ref->alternate_path = talloc_asprintf_append(
 999                                         ref->alternate_path,
1000                                         "%s",
1001                                         pdp->reqpath);
1002                         if (!ref->alternate_path) {
1003                                 TALLOC_FREE(pdp);
1004                                 return NT_STATUS_NO_MEMORY;
1005                         }
1006                 }
1007                 ref->proximity = 0;
1008                 ref->ttl = REFERRAL_TTL;
1009                 jucn->referral_list = ref;
1010                 *consumedcntp = strlen(dfs_path);
1011                 TALLOC_FREE(pdp);
1012                 return NT_STATUS_OK;
1013         }
1014
1015         status = create_conn_struct_cwd(ctx,
1016                                         server_event_context(),
1017                                         server_messaging_context(),
1018                                         &conn, snum,
1019                                         lp_pathname(talloc_tos(), snum), NULL, &oldpath);
1020         if (!NT_STATUS_IS_OK(status)) {
1021                 TALLOC_FREE(pdp);
1022                 return status;
1023         }
1024
1025         /* If this is a DFS path dfs_lookup should return
1026          * NT_STATUS_PATH_NOT_COVERED. */
1027
1028         status = dfs_path_lookup(ctx, conn, dfs_path, pdp,
1029                         False, consumedcntp, &targetpath);
1030
1031         if (!NT_STATUS_EQUAL(status, NT_STATUS_PATH_NOT_COVERED)) {
1032                 DEBUG(3,("get_referred_path: No valid referrals for path %s\n",
1033                         dfs_path));
1034                 goto err_exit;
1035         }
1036
1037         /* We know this is a valid dfs link. Parse the targetpath. */
1038         if (!parse_msdfs_symlink(ctx, targetpath,
1039                                 &jucn->referral_list,
1040                                 &jucn->referral_count)) {
1041                 DEBUG(3,("get_referred_path: failed to parse symlink "
1042                         "target %s\n", targetpath ));
1043                 status = NT_STATUS_NOT_FOUND;
1044                 goto err_exit;
1045         }
1046
1047         status = NT_STATUS_OK;
1048  err_exit:
1049         vfs_ChDir(conn, oldpath);
1050         SMB_VFS_DISCONNECT(conn);
1051         conn_free(conn);
1052         TALLOC_FREE(pdp);
1053         return status;
1054 }
1055
1056 /******************************************************************
1057  Set up the DFS referral for the dfs pathname. This call returns
1058  the amount of the path covered by this server, and where the
1059  client should be redirected to. This is the meat of the
1060  TRANS2_GET_DFS_REFERRAL call.
1061 ******************************************************************/
1062
1063 int setup_dfs_referral(connection_struct *orig_conn,
1064                         const char *dfs_path,
1065                         int max_referral_level,
1066                         char **ppdata, NTSTATUS *pstatus)
1067 {
1068         char *pdata = *ppdata;
1069         int reply_size = 0;
1070         struct dfs_GetDFSReferral *r;
1071         DATA_BLOB blob = data_blob_null;
1072         NTSTATUS status;
1073         enum ndr_err_code ndr_err;
1074
1075         r = talloc_zero(talloc_tos(), struct dfs_GetDFSReferral);
1076         if (r == NULL) {
1077                 *pstatus = NT_STATUS_NO_MEMORY;
1078                 return -1;
1079         }
1080
1081         r->in.req.max_referral_level = max_referral_level;
1082         r->in.req.servername = talloc_strdup(r, dfs_path);
1083         if (r->in.req.servername == NULL) {
1084                 talloc_free(r);
1085                 *pstatus = NT_STATUS_NO_MEMORY;
1086                 return -1;
1087         }
1088
1089         status = SMB_VFS_GET_DFS_REFERRALS(orig_conn, r);
1090         if (!NT_STATUS_IS_OK(status)) {
1091                 talloc_free(r);
1092                 *pstatus = status;
1093                 return -1;
1094         }
1095
1096         ndr_err = ndr_push_struct_blob(&blob, r,
1097                                 r->out.resp,
1098                                 (ndr_push_flags_fn_t)ndr_push_dfs_referral_resp);
1099         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1100                 TALLOC_FREE(r);
1101                 *pstatus = NT_STATUS_INVALID_PARAMETER;
1102                 return -1;
1103         }
1104
1105         pdata = (char *)SMB_REALLOC(pdata, blob.length);
1106         if(pdata == NULL) {
1107                 TALLOC_FREE(r);
1108                 DEBUG(0,("referral setup:"
1109                          "malloc failed for Realloc!\n"));
1110                 return -1;
1111         }
1112         *ppdata = pdata;
1113         reply_size = blob.length;
1114         memcpy(pdata, blob.data, blob.length);
1115         TALLOC_FREE(r);
1116
1117         *pstatus = NT_STATUS_OK;
1118         return reply_size;
1119 }
1120
1121 /**********************************************************************
1122  The following functions are called by the NETDFS RPC pipe functions
1123  **********************************************************************/
1124
1125 /*********************************************************************
1126  Creates a junction structure from a DFS pathname
1127 **********************************************************************/
1128
1129 bool create_junction(TALLOC_CTX *ctx,
1130                 const char *dfs_path,
1131                 bool allow_broken_path,
1132                 struct junction_map *jucn)
1133 {
1134         int snum;
1135         bool dummy;
1136         struct dfs_path *pdp = talloc(ctx,struct dfs_path);
1137         NTSTATUS status;
1138
1139         if (!pdp) {
1140                 return False;
1141         }
1142         status = parse_dfs_path(NULL, dfs_path, False, allow_broken_path,
1143                                 pdp, &dummy);
1144         if (!NT_STATUS_IS_OK(status)) {
1145                 return False;
1146         }
1147
1148         /* check if path is dfs : validate first token */
1149         if (!is_myname_or_ipaddr(pdp->hostname)) {
1150                 DEBUG(4,("create_junction: Invalid hostname %s "
1151                         "in dfs path %s\n",
1152                         pdp->hostname, dfs_path));
1153                 TALLOC_FREE(pdp);
1154                 return False;
1155         }
1156
1157         /* Check for a non-DFS share */
1158         snum = lp_servicenumber(pdp->servicename);
1159
1160         if(snum < 0 || !lp_msdfs_root(snum)) {
1161                 DEBUG(4,("create_junction: %s is not an msdfs root.\n",
1162                         pdp->servicename));
1163                 TALLOC_FREE(pdp);
1164                 return False;
1165         }
1166
1167         jucn->service_name = talloc_strdup(ctx, pdp->servicename);
1168         jucn->volume_name = talloc_strdup(ctx, pdp->reqpath);
1169         jucn->comment = lp_comment(ctx, snum);
1170
1171         TALLOC_FREE(pdp);
1172         if (!jucn->service_name || !jucn->volume_name || ! jucn->comment) {
1173                 return False;
1174         }
1175         return True;
1176 }
1177
1178 /**********************************************************************
1179  Forms a valid Unix pathname from the junction
1180  **********************************************************************/
1181
1182 static bool junction_to_local_path(const struct junction_map *jucn,
1183                                    char **pp_path_out,
1184                                    connection_struct **conn_out,
1185                                    char **oldpath)
1186 {
1187         int snum;
1188         NTSTATUS status;
1189
1190         snum = lp_servicenumber(jucn->service_name);
1191         if(snum < 0) {
1192                 return False;
1193         }
1194         status = create_conn_struct_cwd(talloc_tos(),
1195                                         server_event_context(),
1196                                         server_messaging_context(),
1197                                         conn_out,
1198                                         snum, lp_pathname(talloc_tos(), snum), NULL, oldpath);
1199         if (!NT_STATUS_IS_OK(status)) {
1200                 return False;
1201         }
1202
1203         *pp_path_out = talloc_asprintf(*conn_out,
1204                         "%s/%s",
1205                         lp_pathname(talloc_tos(), snum),
1206                         jucn->volume_name);
1207         if (!*pp_path_out) {
1208                 vfs_ChDir(*conn_out, *oldpath);
1209                 SMB_VFS_DISCONNECT(*conn_out);
1210                 conn_free(*conn_out);
1211                 return False;
1212         }
1213         return True;
1214 }
1215
1216 bool create_msdfs_link(const struct junction_map *jucn)
1217 {
1218         char *path = NULL;
1219         char *cwd;
1220         char *msdfs_link = NULL;
1221         connection_struct *conn;
1222         int i=0;
1223         bool insert_comma = False;
1224         bool ret = False;
1225
1226         if(!junction_to_local_path(jucn, &path, &conn, &cwd)) {
1227                 return False;
1228         }
1229
1230         /* Form the msdfs_link contents */
1231         msdfs_link = talloc_strdup(conn, "msdfs:");
1232         if (!msdfs_link) {
1233                 goto out;
1234         }
1235         for(i=0; i<jucn->referral_count; i++) {
1236                 char *refpath = jucn->referral_list[i].alternate_path;
1237
1238                 /* Alternate paths always use Windows separators. */
1239                 trim_char(refpath, '\\', '\\');
1240                 if(*refpath == '\0') {
1241                         if (i == 0) {
1242                                 insert_comma = False;
1243                         }
1244                         continue;
1245                 }
1246                 if (i > 0 && insert_comma) {
1247                         msdfs_link = talloc_asprintf_append_buffer(msdfs_link,
1248                                         ",%s",
1249                                         refpath);
1250                 } else {
1251                         msdfs_link = talloc_asprintf_append_buffer(msdfs_link,
1252                                         "%s",
1253                                         refpath);
1254                 }
1255
1256                 if (!msdfs_link) {
1257                         goto out;
1258                 }
1259                 if (!insert_comma) {
1260                         insert_comma = True;
1261                 }
1262         }
1263
1264         DEBUG(5,("create_msdfs_link: Creating new msdfs link: %s -> %s\n",
1265                 path, msdfs_link));
1266
1267         if(SMB_VFS_SYMLINK(conn, msdfs_link, path) < 0) {
1268                 if (errno == EEXIST) {
1269                         struct smb_filename *smb_fname = NULL;
1270                         NTSTATUS status;
1271
1272                         status = create_synthetic_smb_fname(talloc_tos(), path,
1273                                                             NULL, NULL,
1274                                                             &smb_fname);
1275                         if (!NT_STATUS_IS_OK(status)) {
1276                                 errno = map_errno_from_nt_status(status);
1277                                 goto out;
1278                         }
1279
1280                         if(SMB_VFS_UNLINK(conn, smb_fname)!=0) {
1281                                 TALLOC_FREE(smb_fname);
1282                                 goto out;
1283                         }
1284                         TALLOC_FREE(smb_fname);
1285                 }
1286                 if (SMB_VFS_SYMLINK(conn, msdfs_link, path) < 0) {
1287                         DEBUG(1,("create_msdfs_link: symlink failed "
1288                                  "%s -> %s\nError: %s\n",
1289                                  path, msdfs_link, strerror(errno)));
1290                         goto out;
1291                 }
1292         }
1293
1294         ret = True;
1295
1296 out:
1297         vfs_ChDir(conn, cwd);
1298         SMB_VFS_DISCONNECT(conn);
1299         conn_free(conn);
1300         return ret;
1301 }
1302
1303 bool remove_msdfs_link(const struct junction_map *jucn)
1304 {
1305         char *path = NULL;
1306         char *cwd;
1307         connection_struct *conn;
1308         bool ret = False;
1309         struct smb_filename *smb_fname = NULL;
1310         NTSTATUS status;
1311
1312         if (!junction_to_local_path(jucn, &path, &conn, &cwd)) {
1313                 return false;
1314         }
1315
1316         status = create_synthetic_smb_fname(talloc_tos(), path,
1317                                             NULL, NULL,
1318                                             &smb_fname);
1319         if (!NT_STATUS_IS_OK(status)) {
1320                 errno = map_errno_from_nt_status(status);
1321                 return false;
1322         }
1323
1324         if( SMB_VFS_UNLINK(conn, smb_fname) == 0 ) {
1325                 ret = True;
1326         }
1327
1328         TALLOC_FREE(smb_fname);
1329         vfs_ChDir(conn, cwd);
1330         SMB_VFS_DISCONNECT(conn);
1331         conn_free(conn);
1332         return ret;
1333 }
1334
1335 /*********************************************************************
1336  Return the number of DFS links at the root of this share.
1337 *********************************************************************/
1338
1339 static int count_dfs_links(TALLOC_CTX *ctx, int snum)
1340 {
1341         size_t cnt = 0;
1342         DIR *dirp = NULL;
1343         const char *dname = NULL;
1344         char *talloced = NULL;
1345         const char *connect_path = lp_pathname(talloc_tos(), snum);
1346         const char *msdfs_proxy = lp_msdfs_proxy(talloc_tos(), snum);
1347         connection_struct *conn;
1348         NTSTATUS status;
1349         char *cwd;
1350
1351         if(*connect_path == '\0') {
1352                 return 0;
1353         }
1354
1355         /*
1356          * Fake up a connection struct for the VFS layer.
1357          */
1358
1359         status = create_conn_struct_cwd(talloc_tos(),
1360                                         server_event_context(),
1361                                         server_messaging_context(),
1362                                         &conn,
1363                                         snum, connect_path, NULL, &cwd);
1364         if (!NT_STATUS_IS_OK(status)) {
1365                 DEBUG(3, ("create_conn_struct failed: %s\n",
1366                           nt_errstr(status)));
1367                 return 0;
1368         }
1369
1370         /* Count a link for the msdfs root - convention */
1371         cnt = 1;
1372
1373         /* No more links if this is an msdfs proxy. */
1374         if (*msdfs_proxy != '\0') {
1375                 goto out;
1376         }
1377
1378         /* Now enumerate all dfs links */
1379         dirp = SMB_VFS_OPENDIR(conn, ".", NULL, 0);
1380         if(!dirp) {
1381                 goto out;
1382         }
1383
1384         while ((dname = vfs_readdirname(conn, dirp, NULL, &talloced))
1385                != NULL) {
1386                 if (is_msdfs_link(conn,
1387                                 dname,
1388                                 NULL)) {
1389                         cnt++;
1390                 }
1391                 TALLOC_FREE(talloced);
1392         }
1393
1394         SMB_VFS_CLOSEDIR(conn,dirp);
1395
1396 out:
1397         vfs_ChDir(conn, cwd);
1398         SMB_VFS_DISCONNECT(conn);
1399         conn_free(conn);
1400         return cnt;
1401 }
1402
1403 /*********************************************************************
1404 *********************************************************************/
1405
1406 static int form_junctions(TALLOC_CTX *ctx,
1407                                 int snum,
1408                                 struct junction_map *jucn,
1409                                 size_t jn_remain)
1410 {
1411         size_t cnt = 0;
1412         DIR *dirp = NULL;
1413         const char *dname = NULL;
1414         char *talloced = NULL;
1415         const char *connect_path = lp_pathname(talloc_tos(), snum);
1416         char *service_name = lp_servicename(talloc_tos(), snum);
1417         const char *msdfs_proxy = lp_msdfs_proxy(talloc_tos(), snum);
1418         connection_struct *conn;
1419         struct referral *ref = NULL;
1420         char *cwd;
1421         NTSTATUS status;
1422
1423         if (jn_remain == 0) {
1424                 return 0;
1425         }
1426
1427         if(*connect_path == '\0') {
1428                 return 0;
1429         }
1430
1431         /*
1432          * Fake up a connection struct for the VFS layer.
1433          */
1434
1435         status = create_conn_struct_cwd(ctx,
1436                                         server_event_context(),
1437                                         server_messaging_context(),
1438                                         &conn, snum, connect_path, NULL,
1439                                         &cwd);
1440         if (!NT_STATUS_IS_OK(status)) {
1441                 DEBUG(3, ("create_conn_struct failed: %s\n",
1442                           nt_errstr(status)));
1443                 return 0;
1444         }
1445
1446         /* form a junction for the msdfs root - convention
1447            DO NOT REMOVE THIS: NT clients will not work with us
1448            if this is not present
1449         */
1450         jucn[cnt].service_name = talloc_strdup(ctx,service_name);
1451         jucn[cnt].volume_name = talloc_strdup(ctx, "");
1452         if (!jucn[cnt].service_name || !jucn[cnt].volume_name) {
1453                 goto out;
1454         }
1455         jucn[cnt].comment = "";
1456         jucn[cnt].referral_count = 1;
1457
1458         ref = jucn[cnt].referral_list = talloc_zero(ctx, struct referral);
1459         if (jucn[cnt].referral_list == NULL) {
1460                 goto out;
1461         }
1462
1463         ref->proximity = 0;
1464         ref->ttl = REFERRAL_TTL;
1465         if (*msdfs_proxy != '\0') {
1466                 ref->alternate_path = talloc_strdup(ctx,
1467                                                 msdfs_proxy);
1468         } else {
1469                 ref->alternate_path = talloc_asprintf(ctx,
1470                         "\\\\%s\\%s",
1471                         get_local_machine_name(),
1472                         service_name);
1473         }
1474
1475         if (!ref->alternate_path) {
1476                 goto out;
1477         }
1478         cnt++;
1479
1480         /* Don't enumerate if we're an msdfs proxy. */
1481         if (*msdfs_proxy != '\0') {
1482                 goto out;
1483         }
1484
1485         /* Now enumerate all dfs links */
1486         dirp = SMB_VFS_OPENDIR(conn, ".", NULL, 0);
1487         if(!dirp) {
1488                 goto out;
1489         }
1490
1491         while ((dname = vfs_readdirname(conn, dirp, NULL, &talloced))
1492                != NULL) {
1493                 char *link_target = NULL;
1494                 if (cnt >= jn_remain) {
1495                         DEBUG(2, ("form_junctions: ran out of MSDFS "
1496                                 "junction slots"));
1497                         TALLOC_FREE(talloced);
1498                         goto out;
1499                 }
1500                 if (is_msdfs_link_internal(ctx,
1501                                         conn,
1502                                         dname, &link_target,
1503                                         NULL)) {
1504                         if (parse_msdfs_symlink(ctx,
1505                                         link_target,
1506                                         &jucn[cnt].referral_list,
1507                                         &jucn[cnt].referral_count)) {
1508
1509                                 jucn[cnt].service_name = talloc_strdup(ctx,
1510                                                                 service_name);
1511                                 jucn[cnt].volume_name = talloc_strdup(ctx,
1512                                                                 dname);
1513                                 if (!jucn[cnt].service_name ||
1514                                                 !jucn[cnt].volume_name) {
1515                                         TALLOC_FREE(talloced);
1516                                         goto out;
1517                                 }
1518                                 jucn[cnt].comment = "";
1519                                 cnt++;
1520                         }
1521                         TALLOC_FREE(link_target);
1522                 }
1523                 TALLOC_FREE(talloced);
1524         }
1525
1526 out:
1527
1528         if (dirp) {
1529                 SMB_VFS_CLOSEDIR(conn,dirp);
1530         }
1531
1532         vfs_ChDir(conn, cwd);
1533         conn_free(conn);
1534         return cnt;
1535 }
1536
1537 struct junction_map *enum_msdfs_links(TALLOC_CTX *ctx, size_t *p_num_jn)
1538 {
1539         struct junction_map *jn = NULL;
1540         int i=0;
1541         size_t jn_count = 0;
1542         int sharecount = 0;
1543
1544         *p_num_jn = 0;
1545         if(!lp_host_msdfs()) {
1546                 return NULL;
1547         }
1548
1549         /* Ensure all the usershares are loaded. */
1550         become_root();
1551         load_registry_shares();
1552         sharecount = load_usershare_shares(NULL, connections_snum_used);
1553         unbecome_root();
1554
1555         for(i=0;i < sharecount;i++) {
1556                 if(lp_msdfs_root(i)) {
1557                         jn_count += count_dfs_links(ctx, i);
1558                 }
1559         }
1560         if (jn_count == 0) {
1561                 return NULL;
1562         }
1563         jn = talloc_array(ctx,  struct junction_map, jn_count);
1564         if (!jn) {
1565                 return NULL;
1566         }
1567         for(i=0; i < sharecount; i++) {
1568                 if (*p_num_jn >= jn_count) {
1569                         break;
1570                 }
1571                 if(lp_msdfs_root(i)) {
1572                         *p_num_jn += form_junctions(ctx, i,
1573                                         &jn[*p_num_jn],
1574                                         jn_count - *p_num_jn);
1575                 }
1576         }
1577         return jn;
1578 }
1579
1580 /******************************************************************************
1581  Core function to resolve a dfs pathname possibly containing a wildcard.  If
1582  ppath_contains_wcard != NULL, it will be set to true if a wildcard is
1583  detected during dfs resolution.
1584 ******************************************************************************/
1585
1586 NTSTATUS resolve_dfspath_wcard(TALLOC_CTX *ctx,
1587                                 connection_struct *conn,
1588                                 bool dfs_pathnames,
1589                                 const char *name_in,
1590                                 bool allow_wcards,
1591                                 bool allow_broken_path,
1592                                 char **pp_name_out,
1593                                 bool *ppath_contains_wcard)
1594 {
1595         bool path_contains_wcard;
1596         NTSTATUS status = NT_STATUS_OK;
1597
1598         if (dfs_pathnames) {
1599                 status = dfs_redirect(ctx,
1600                                         conn,
1601                                         name_in,
1602                                         allow_wcards,
1603                                         allow_broken_path,
1604                                         pp_name_out,
1605                                         &path_contains_wcard);
1606
1607                 if (NT_STATUS_IS_OK(status) && ppath_contains_wcard != NULL) {
1608                         *ppath_contains_wcard = path_contains_wcard;
1609                 }
1610         } else {
1611                 /*
1612                  * Cheat and just return a copy of the in ptr.
1613                  * Once srvstr_get_path() uses talloc it'll
1614                  * be a talloced ptr anyway.
1615                  */
1616                 *pp_name_out = discard_const_p(char, name_in);
1617         }
1618         return status;
1619 }