LCOV - code coverage report
Current view: top level - source3/smbd - service.c (source / functions) Hit Total Coverage
Test: coverage report for master 6248eab5 Lines: 335 510 65.7 %
Date: 2021-08-25 13:27:56 Functions: 16 16 100.0 %

          Line data    Source code
       1             : /* 
       2             :    Unix SMB/CIFS implementation.
       3             :    service (connection) opening and closing
       4             :    Copyright (C) Andrew Tridgell 1992-1998
       5             : 
       6             :    This program is free software; you can redistribute it and/or modify
       7             :    it under the terms of the GNU General Public License as published by
       8             :    the Free Software Foundation; either version 3 of the License, or
       9             :    (at your option) any later version.
      10             : 
      11             :    This program is distributed in the hope that it will be useful,
      12             :    but WITHOUT ANY WARRANTY; without even the implied warranty of
      13             :    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
      14             :    GNU General Public License for more details.
      15             : 
      16             :    You should have received a copy of the GNU General Public License
      17             :    along with this program.  If not, see <http://www.gnu.org/licenses/>.
      18             : */
      19             : 
      20             : #include "includes.h"
      21             : #include "system/filesys.h"
      22             : #include "system/passwd.h" /* uid_wrapper */
      23             : #include "../lib/tsocket/tsocket.h"
      24             : #include "smbd/smbd.h"
      25             : #include "smbd/globals.h"
      26             : #include "../librpc/gen_ndr/netlogon.h"
      27             : #include "../libcli/security/security.h"
      28             : #include "printing/pcap.h"
      29             : #include "passdb/lookup_sid.h"
      30             : #include "auth.h"
      31             : #include "../auth/auth_util.h"
      32             : #include "lib/param/loadparm.h"
      33             : #include "messages.h"
      34             : #include "lib/afs/afs_funcs.h"
      35             : #include "lib/util_path.h"
      36             : #include "lib/util/string_wrappers.h"
      37             : 
      38       89337 : bool canonicalize_connect_path(connection_struct *conn)
      39             : {
      40             :         bool ret;
      41       89337 :         struct smb_filename con_fname = { .base_name = conn->connectpath };
      42       89337 :         struct smb_filename *resolved_fname = SMB_VFS_REALPATH(conn, talloc_tos(),
      43             :                                                 &con_fname);
      44       89337 :         if (resolved_fname == NULL) {
      45          58 :                 return false;
      46             :         }
      47       89279 :         ret = set_conn_connectpath(conn,resolved_fname->base_name);
      48       89279 :         TALLOC_FREE(resolved_fname);
      49       89279 :         return ret;
      50             : }
      51             : 
      52             : /****************************************************************************
      53             :  Ensure when setting connectpath it is a canonicalized (no ./ // or ../)
      54             :  absolute path stating in / and not ending in /.
      55             : ****************************************************************************/
      56             : 
      57      136126 : bool set_conn_connectpath(connection_struct *conn, const char *connectpath)
      58             : {
      59             :         char *destname;
      60             : 
      61      136126 :         if (connectpath == NULL || connectpath[0] == '\0') {
      62           0 :                 return false;
      63             :         }
      64             : 
      65      136126 :         destname = canonicalize_absolute_path(conn, connectpath);
      66      136126 :         if (destname == NULL) {
      67           0 :                 return false;
      68             :         }
      69             : 
      70      136126 :         DBG_DEBUG("service %s, connectpath = %s\n",
      71             :                   lp_const_servicename(SNUM(conn)), destname);
      72             : 
      73      136126 :         talloc_free(conn->connectpath);
      74      136126 :         conn->connectpath = destname;
      75             :         /*
      76             :          * Ensure conn->cwd_fsp->fsp_name is initialized.
      77             :          * start as conn->connectpath.
      78             :          */
      79      136126 :         TALLOC_FREE(conn->cwd_fsp->fsp_name);
      80      136126 :         conn->cwd_fsp->fsp_name = synthetic_smb_fname(conn,
      81      136126 :                                 conn->connectpath,
      82             :                                 NULL,
      83             :                                 NULL,
      84             :                                 0,
      85             :                                 0);
      86      136126 :         if (conn->cwd_fsp->fsp_name == NULL) {
      87           0 :                 return false;
      88             :         }
      89      136126 :         return true;
      90             : }
      91             : 
      92             : /****************************************************************************
      93             :  Load parameters specific to a connection/service.
      94             : ****************************************************************************/
      95             : 
      96      338276 : void set_current_case_sensitive(connection_struct *conn, uint16_t flags)
      97             : {
      98             :         int snum;
      99             :         enum remote_arch_types ra_type;
     100             : 
     101      338276 :         SMB_ASSERT(conn != NULL);
     102             : 
     103      338276 :         snum = SNUM(conn);
     104             : 
     105      338276 :         if ((conn == last_conn) && (last_flags == flags)) {
     106      323774 :                 return;
     107             :         }
     108             : 
     109        7321 :         last_conn = conn;
     110        7321 :         last_flags = flags;
     111             : 
     112             :         /*
     113             :          * Obey the client case sensitivity requests - only for clients that
     114             :          * support it. */
     115        7321 :         switch (lp_case_sensitive(snum)) {
     116        7261 :         case Auto:
     117             :                 /*
     118             :                  * We need this uglyness due to DOS/Win9x clients that lie
     119             :                  * about case insensitivity. */
     120        7261 :                 ra_type = get_remote_arch();
     121        7261 :                 if (conn->sconn->using_smb2) {
     122           0 :                         conn->case_sensitive = false;
     123        7261 :                 } else if ((ra_type != RA_SAMBA) && (ra_type != RA_CIFSFS)) {
     124             :                         /*
     125             :                          * Client can't support per-packet case sensitive
     126             :                          * pathnames. */
     127           0 :                         conn->case_sensitive = false;
     128             :                 } else {
     129        7261 :                         conn->case_sensitive =
     130        7261 :                                         !(flags & FLAG_CASELESS_PATHNAMES);
     131             :                 }
     132        7164 :         break;
     133          60 :         case True:
     134          60 :                 conn->case_sensitive = true;
     135          60 :                 break;
     136           0 :         default:
     137           0 :                 conn->case_sensitive = false;
     138           0 :                 break;
     139             :         }
     140        7224 :         return;
     141             : }
     142             : 
     143     1866210 : bool chdir_current_service(connection_struct *conn)
     144             : {
     145     3732420 :         const struct smb_filename connectpath_fname = {
     146     1866210 :                 .base_name = conn->connectpath,
     147             :         };
     148     1866210 :         int saved_errno = 0;
     149     1866210 :         char *utok_str = NULL;
     150             :         int ret;
     151             : 
     152     1866210 :         conn->lastused_count++;
     153             : 
     154     1866210 :         ret = vfs_ChDir(conn, &connectpath_fname);
     155     1866210 :         if (ret == 0) {
     156     1850538 :                 return true;
     157             :         }
     158         136 :         saved_errno = errno;
     159             : 
     160         136 :         utok_str = utok_string(talloc_tos(),
     161         136 :                                conn->session_info->unix_token);
     162         136 :         if (utok_str == NULL) {
     163           0 :                 errno = saved_errno;
     164           0 :                 return false;
     165             :         }
     166             : 
     167         136 :         DBG_ERR("vfs_ChDir(%s) failed: %s. Current token: %s\n",
     168             :                 conn->connectpath,
     169             :                 strerror(saved_errno),
     170             :                 utok_str);
     171             : 
     172         136 :         if (saved_errno != 0) {
     173         136 :                 errno = saved_errno;
     174             :         }
     175         136 :         return false;
     176             : }
     177             : 
     178             : /****************************************************************************
     179             :  do some basic sainity checks on the share.  
     180             :  This function modifies dev, ecode.
     181             : ****************************************************************************/
     182             : 
     183       42564 : static NTSTATUS share_sanity_checks(const struct tsocket_address *remote_address,
     184             :                                     const char *rhost,
     185             :                                     int snum,
     186             :                                     fstring dev)
     187             : {
     188             :         char *raddr;
     189             : 
     190       42564 :         raddr = tsocket_address_inet_addr_string(remote_address,
     191             :                                                  talloc_tos());
     192       42564 :         if (raddr == NULL) {
     193           0 :                 return NT_STATUS_NO_MEMORY;
     194             :         }
     195             : 
     196       85128 :         if (!lp_snum_ok(snum) ||
     197       42564 :             !allow_access(lp_hosts_deny(snum), lp_hosts_allow(snum),
     198             :                           rhost, raddr)) {
     199           0 :                 return NT_STATUS_ACCESS_DENIED;
     200             :         }
     201             : 
     202       42564 :         if (dev[0] == '?' || !dev[0]) {
     203       39944 :                 if (lp_printable(snum)) {
     204          28 :                         fstrcpy(dev,"LPT1:");
     205       39916 :                 } else if (strequal(lp_fstype(snum), "IPC")) {
     206       21137 :                         fstrcpy(dev, "IPC");
     207             :                 } else {
     208       18779 :                         fstrcpy(dev,"A:");
     209             :                 }
     210             :         }
     211             : 
     212       42564 :         if (!strupper_m(dev)) {
     213           0 :                 DEBUG(2,("strupper_m %s failed\n", dev));
     214           0 :                 return NT_STATUS_INVALID_PARAMETER;
     215             :         }
     216             : 
     217       42564 :         if (lp_printable(snum)) {
     218          28 :                 if (!strequal(dev, "LPT1:")) {
     219           0 :                         return NT_STATUS_BAD_DEVICE_TYPE;
     220             :                 }
     221       42536 :         } else if (strequal(lp_fstype(snum), "IPC")) {
     222       23637 :                 if (!strequal(dev, "IPC")) {
     223          27 :                         return NT_STATUS_BAD_DEVICE_TYPE;
     224             :                 }
     225       18899 :         } else if (!strequal(dev, "A:")) {
     226          27 :                 return NT_STATUS_BAD_DEVICE_TYPE;
     227             :         }
     228             : 
     229             :         /* Behave as a printer if we are supposed to */
     230       42510 :         if (lp_printable(snum) && (strcmp(dev, "A:") == 0)) {
     231           0 :                 fstrcpy(dev, "LPT1:");
     232             :         }
     233             : 
     234       42510 :         return NT_STATUS_OK;
     235             : }
     236             : 
     237             : /*
     238             :  * Go through lookup_name etc to find the force'd group.  
     239             :  *
     240             :  * Create a new token from src_token, replacing the primary group sid with the
     241             :  * one found.
     242             :  */
     243             : 
     244         130 : static NTSTATUS find_forced_group(bool force_user,
     245             :                                   int snum, const char *username,
     246             :                                   struct dom_sid *pgroup_sid,
     247             :                                   gid_t *pgid)
     248             : {
     249         130 :         NTSTATUS result = NT_STATUS_NO_SUCH_GROUP;
     250         130 :         TALLOC_CTX *frame = talloc_stackframe();
     251         130 :         const struct loadparm_substitution *lp_sub =
     252             :                 loadparm_s3_global_substitution();
     253             :         struct dom_sid group_sid;
     254             :         enum lsa_SidType type;
     255             :         char *groupname;
     256         130 :         bool user_must_be_member = False;
     257             :         gid_t gid;
     258             : 
     259         130 :         groupname = lp_force_group(talloc_tos(), lp_sub, snum);
     260         130 :         if (groupname == NULL) {
     261           0 :                 DEBUG(1, ("talloc_strdup failed\n"));
     262           0 :                 result = NT_STATUS_NO_MEMORY;
     263           0 :                 goto done;
     264             :         }
     265             : 
     266         130 :         if (groupname[0] == '+') {
     267           0 :                 user_must_be_member = True;
     268           0 :                 groupname += 1;
     269             :         }
     270             : 
     271         130 :         groupname = talloc_string_sub(talloc_tos(), groupname,
     272             :                                       "%S", lp_const_servicename(snum));
     273         130 :         if (groupname == NULL) {
     274           0 :                 DEBUG(1, ("talloc_string_sub failed\n"));
     275           0 :                 result = NT_STATUS_NO_MEMORY;
     276           0 :                 goto done;
     277             :         }
     278             : 
     279         130 :         if (!lookup_name_smbconf(talloc_tos(), groupname,
     280             :                          LOOKUP_NAME_ALL|LOOKUP_NAME_GROUP,
     281             :                          NULL, NULL, &group_sid, &type)) {
     282           0 :                 DEBUG(10, ("lookup_name_smbconf(%s) failed\n",
     283             :                            groupname));
     284           0 :                 goto done;
     285             :         }
     286             : 
     287         130 :         if ((type != SID_NAME_DOM_GRP) && (type != SID_NAME_ALIAS) &&
     288           0 :             (type != SID_NAME_WKN_GRP)) {
     289           0 :                 DEBUG(10, ("%s is a %s, not a group\n", groupname,
     290             :                            sid_type_lookup(type)));
     291           0 :                 goto done;
     292             :         }
     293             : 
     294         130 :         if (!sid_to_gid(&group_sid, &gid)) {
     295             :                 struct dom_sid_buf buf;
     296           0 :                 DEBUG(10, ("sid_to_gid(%s) for %s failed\n",
     297             :                            dom_sid_str_buf(&group_sid, &buf), groupname));
     298           0 :                 goto done;
     299             :         }
     300             : 
     301             :         /*
     302             :          * If the user has been forced and the forced group starts with a '+',
     303             :          * then we only set the group to be the forced group if the forced
     304             :          * user is a member of that group.  Otherwise, the meaning of the '+'
     305             :          * would be ignored.
     306             :          */
     307             : 
     308         130 :         if (force_user && user_must_be_member) {
     309           0 :                 if (user_in_group_sid(username, &group_sid)) {
     310           0 :                         sid_copy(pgroup_sid, &group_sid);
     311           0 :                         *pgid = gid;
     312           0 :                         DEBUG(3,("Forced group %s for member %s\n",
     313             :                                  groupname, username));
     314             :                 } else {
     315           0 :                         DEBUG(0,("find_forced_group: forced user %s is not a member "
     316             :                                 "of forced group %s. Disallowing access.\n",
     317             :                                 username, groupname ));
     318           0 :                         result = NT_STATUS_MEMBER_NOT_IN_GROUP;
     319           0 :                         goto done;
     320             :                 }
     321             :         } else {
     322         130 :                 sid_copy(pgroup_sid, &group_sid);
     323         130 :                 *pgid = gid;
     324         130 :                 DEBUG(3,("Forced group %s\n", groupname));
     325             :         }
     326             : 
     327         130 :         result = NT_STATUS_OK;
     328         130 :  done:
     329         130 :         TALLOC_FREE(frame);
     330         130 :         return result;
     331             : }
     332             : 
     333             : /****************************************************************************
     334             :   Create an auth_session_info structure for a connection_struct
     335             : ****************************************************************************/
     336             : 
     337       42510 : static NTSTATUS create_connection_session_info(struct smbd_server_connection *sconn,
     338             :                                               TALLOC_CTX *mem_ctx, int snum,
     339             :                                               struct auth_session_info *session_info,
     340             :                                               struct auth_session_info **presult)
     341             : {
     342             :         struct auth_session_info *result;
     343             : 
     344       42510 :         if (lp_guest_only(snum)) {
     345         128 :                 return make_session_info_guest(mem_ctx, presult);
     346             :         }
     347             : 
     348             :         /*
     349             :          * This is the normal security != share case where we have a
     350             :          * valid vuid from the session setup.                 */
     351             : 
     352       42382 :         if (security_session_user_level(session_info, NULL) < SECURITY_USER) {
     353         984 :                 if (!lp_guest_ok(snum)) {
     354           4 :                         DBG_WARNING("guest user (from session setup) "
     355             :                                   "not permitted to access this share "
     356             :                                   "(%s)\n", lp_const_servicename(snum));
     357           4 :                         return NT_STATUS_ACCESS_DENIED;
     358             :                 }
     359             :         } else {
     360       41398 :                 if (!user_ok_token(session_info->unix_info->unix_name,
     361       41398 :                                    session_info->info->domain_name,
     362       41398 :                                    session_info->security_token, snum)) {
     363           8 :                         DBG_WARNING("user '%s' (from session setup) not "
     364             :                                   "permitted to access this share "
     365             :                                   "(%s)\n",
     366             :                                   session_info->unix_info->unix_name,
     367             :                                   lp_const_servicename(snum));
     368           8 :                         return NT_STATUS_ACCESS_DENIED;
     369             :                 }
     370             :         }
     371             : 
     372       42370 :         result = copy_session_info(mem_ctx, session_info);
     373       42370 :         if (result == NULL) {
     374           0 :                 return NT_STATUS_NO_MEMORY;
     375             :         }
     376             : 
     377       42370 :         *presult = result;
     378       42370 :         return NT_STATUS_OK;
     379             : }
     380             : 
     381             : /****************************************************************************
     382             :   Set relevant user and group settings corresponding to force user/group
     383             :   configuration for the given snum.
     384             : ****************************************************************************/
     385             : 
     386       42592 : NTSTATUS set_conn_force_user_group(connection_struct *conn, int snum)
     387             : {
     388       42592 :         const struct loadparm_substitution *lp_sub =
     389             :                 loadparm_s3_global_substitution();
     390             :         NTSTATUS status;
     391             : 
     392       42592 :         if (*lp_force_user(talloc_tos(), lp_sub, snum)) {
     393             : 
     394             :                 /*
     395             :                  * Replace conn->session_info with a completely faked up one
     396             :                  * from the username we are forced into :-)
     397             :                  */
     398             : 
     399             :                 char *fuser;
     400             :                 char *sanitized_username;
     401             :                 struct auth_session_info *forced_serverinfo;
     402             :                 bool guest;
     403             : 
     404         246 :                 fuser = talloc_string_sub(conn, lp_force_user(talloc_tos(), lp_sub, snum), "%S",
     405             :                                           lp_const_servicename(snum));
     406         246 :                 if (fuser == NULL) {
     407           0 :                         return NT_STATUS_NO_MEMORY;
     408             :                 }
     409             : 
     410         246 :                 guest = security_session_user_level(conn->session_info, NULL) < SECURITY_USER;
     411             : 
     412         246 :                 status = make_session_info_from_username(
     413             :                         conn, fuser,
     414             :                         guest,
     415             :                         &forced_serverinfo);
     416         246 :                 if (!NT_STATUS_IS_OK(status)) {
     417           0 :                         return status;
     418             :                 }
     419             : 
     420             :                 /* We don't want to replace the original sanitized_username
     421             :                    as it is the original user given in the connect attempt.
     422             :                    This is used in '%U' substitutions. */
     423         246 :                 sanitized_username = discard_const_p(char,
     424             :                         forced_serverinfo->unix_info->sanitized_username);
     425         246 :                 TALLOC_FREE(sanitized_username);
     426         492 :                 forced_serverinfo->unix_info->sanitized_username =
     427         492 :                         talloc_move(forced_serverinfo->unix_info,
     428             :                                 &conn->session_info->unix_info->sanitized_username);
     429             : 
     430         246 :                 TALLOC_FREE(conn->session_info);
     431         246 :                 conn->session_info = forced_serverinfo;
     432             : 
     433         246 :                 conn->force_user = true;
     434         246 :                 DEBUG(3,("Forced user %s\n", fuser));
     435             :         }
     436             : 
     437             :         /*
     438             :          * If force group is true, then override
     439             :          * any groupid stored for the connecting user.
     440             :          */
     441             : 
     442       42592 :         if (*lp_force_group(talloc_tos(), lp_sub, snum)) {
     443             : 
     444         520 :                 status = find_forced_group(
     445         260 :                         conn->force_user, snum, conn->session_info->unix_info->unix_name,
     446         130 :                         &conn->session_info->security_token->sids[1],
     447         130 :                         &conn->session_info->unix_token->gid);
     448             : 
     449         130 :                 if (!NT_STATUS_IS_OK(status)) {
     450           0 :                         return status;
     451             :                 }
     452             : 
     453             :                 /*
     454             :                  * We need to cache this gid, to use within
     455             :                  * change_to_user() separately from the conn->session_info
     456             :                  * struct. We only use conn->session_info directly if
     457             :                  * "force_user" was set.
     458             :                  */
     459         130 :                 conn->force_group_gid = conn->session_info->unix_token->gid;
     460             :         }
     461             : 
     462       42592 :         return NT_STATUS_OK;
     463             : }
     464             : 
     465       18708 : static NTSTATUS notify_init_sconn(struct smbd_server_connection *sconn)
     466             : {
     467             :         NTSTATUS status;
     468             : 
     469       18708 :         if (sconn->notify_ctx != NULL) {
     470        1387 :                 return NT_STATUS_OK;
     471             :         }
     472             : 
     473       17321 :         sconn->notify_ctx = notify_init(sconn, sconn->msg_ctx,
     474             :                                         sconn, notify_callback);
     475       17321 :         if (sconn->notify_ctx == NULL) {
     476           0 :                 return NT_STATUS_NO_MEMORY;
     477             :         }
     478             : 
     479       17321 :         status = messaging_register(sconn->msg_ctx, sconn,
     480             :                                     MSG_SMB_NOTIFY_CANCEL_DELETED,
     481             :                                     smbd_notify_cancel_deleted);
     482       17321 :         if (!NT_STATUS_IS_OK(status)) {
     483           0 :                 DBG_DEBUG("messaging_register failed: %s\n",
     484             :                           nt_errstr(status));
     485           0 :                 TALLOC_FREE(sconn->notify_ctx);
     486           0 :                 return status;
     487             :         }
     488             : 
     489       17321 :         status = messaging_register(sconn->msg_ctx, sconn,
     490             :                                     MSG_SMB_NOTIFY_STARTED,
     491             :                                     smbd_notifyd_restarted);
     492       17321 :         if (!NT_STATUS_IS_OK(status)) {
     493           0 :                 DBG_DEBUG("messaging_register failed: %s\n",
     494             :                           nt_errstr(status));
     495           0 :                 messaging_deregister(sconn->msg_ctx,
     496             :                                      MSG_SMB_NOTIFY_CANCEL_DELETED, sconn);
     497           0 :                 TALLOC_FREE(sconn->notify_ctx);
     498           0 :                 return status;
     499             :         }
     500             : 
     501       17321 :         return NT_STATUS_OK;
     502             : }
     503             : 
     504             : /****************************************************************************
     505             :   Make a connection, given the snum to connect to, and the vuser of the
     506             :   connecting user if appropriate.
     507             : ****************************************************************************/
     508             : 
     509       42564 : static NTSTATUS make_connection_snum(struct smbXsrv_connection *xconn,
     510             :                                         connection_struct *conn,
     511             :                                         int snum,
     512             :                                         struct smbXsrv_session *session,
     513             :                                         const char *pdev)
     514             : {
     515       42564 :         struct smbd_server_connection *sconn = xconn->client->sconn;
     516       42564 :         const struct loadparm_substitution *lp_sub =
     517             :                 loadparm_s3_global_substitution();
     518       42564 :         struct smb_filename *smb_fname_cpath = NULL;
     519             :         fstring dev;
     520             :         int ret;
     521       42564 :         bool on_err_call_dis_hook = false;
     522             :         uid_t effuid;
     523             :         gid_t effgid;
     524             :         NTSTATUS status;
     525             :         bool ok;
     526             : 
     527       42564 :         fstrcpy(dev, pdev);
     528             : 
     529       42564 :         status = share_sanity_checks(sconn->remote_address,
     530             :                                        sconn->remote_hostname,
     531             :                                        snum,
     532             :                                        dev);
     533       42564 :         if (NT_STATUS_IS_ERR(status)) {
     534          48 :                 goto err_root_exit;
     535             :         }
     536             : 
     537       42510 :         conn->params->service = snum;
     538             : 
     539       85020 :         status = create_connection_session_info(sconn,
     540       42510 :                 conn, snum, session->global->auth_session_info,
     541             :                 &conn->session_info);
     542             : 
     543       42510 :         if (!NT_STATUS_IS_OK(status)) {
     544          12 :                 DEBUG(1, ("create_connection_session_info failed: %s\n",
     545             :                           nt_errstr(status)));
     546          12 :                 goto err_root_exit;
     547             :         }
     548             : 
     549       42498 :         if (lp_guest_only(snum)) {
     550         128 :                 conn->force_user = true;
     551             :         }
     552             : 
     553       42498 :         conn->num_files_open = 0;
     554       42498 :         conn->lastused = conn->lastused_count = time(NULL);
     555       42498 :         conn->printer = (strncmp(dev,"LPT",3) == 0);
     556       85123 :         conn->ipc = ( (strncmp(dev,"IPC",3) == 0) ||
     557       18888 :                       ( lp_enable_asu_support() && strequal(dev,"ADMIN$")) );
     558             : 
     559             :         /* Case options for the share. */
     560       42498 :         conn_setup_case_options(conn);
     561             : 
     562       42498 :         conn->encrypt_level = lp_server_smb_encrypt(snum);
     563       42498 :         if (conn->encrypt_level > SMB_ENCRYPTION_OFF) {
     564         238 :                 if (lp_server_smb_encrypt(-1) == SMB_ENCRYPTION_OFF) {
     565          12 :                         if (conn->encrypt_level == SMB_ENCRYPTION_REQUIRED) {
     566           0 :                                 DBG_ERR("Service [%s] requires encryption, but "
     567             :                                         "it is disabled globally!\n",
     568             :                                         lp_const_servicename(snum));
     569           0 :                                 status = NT_STATUS_ACCESS_DENIED;
     570           0 :                                 goto err_root_exit;
     571             :                         }
     572          12 :                         conn->encrypt_level = SMB_ENCRYPTION_OFF;
     573             :                 }
     574             :         }
     575             : 
     576       42498 :         conn->veto_list = NULL;
     577       42498 :         conn->hide_list = NULL;
     578       42498 :         conn->veto_oplock_list = NULL;
     579       42498 :         conn->aio_write_behind_list = NULL;
     580             : 
     581       42498 :         conn->read_only = lp_read_only(SNUM(conn));
     582             : 
     583       42498 :         status = set_conn_force_user_group(conn, snum);
     584       42498 :         if (!NT_STATUS_IS_OK(status)) {
     585           0 :                 goto err_root_exit;
     586             :         }
     587             : 
     588       42498 :         conn->vuid = session->global->session_wire_id;
     589             : 
     590             :         {
     591      212490 :                 char *s = talloc_sub_full(talloc_tos(),
     592       42498 :                                         lp_const_servicename(SNUM(conn)),
     593       41971 :                                         conn->session_info->unix_info->unix_name,
     594       42498 :                                         conn->connectpath,
     595       42498 :                                         conn->session_info->unix_token->gid,
     596       42498 :                                         conn->session_info->unix_info->sanitized_username,
     597       42498 :                                         conn->session_info->info->domain_name,
     598       42498 :                                         lp_path(talloc_tos(), lp_sub, snum));
     599       42498 :                 if (!s) {
     600           0 :                         status = NT_STATUS_NO_MEMORY;
     601           0 :                         goto err_root_exit;
     602             :                 }
     603             : 
     604       42498 :                 if (!set_conn_connectpath(conn,s)) {
     605           0 :                         TALLOC_FREE(s);
     606           0 :                         status = NT_STATUS_NO_MEMORY;
     607           0 :                         goto err_root_exit;
     608             :                 }
     609       42498 :                 DBG_NOTICE("Connect path is '%s' for service [%s]\n", s,
     610             :                            lp_const_servicename(snum));
     611       42498 :                 TALLOC_FREE(s);
     612             :         }
     613             : 
     614             :         /*
     615             :          * Set up the share security descriptor.
     616             :          * NOTE - we use the *INCOMING USER* session_info
     617             :          * here, as does (indirectly) change_to_user(),
     618             :          * which can be called on any incoming packet.
     619             :          * This way we set up the share access based
     620             :          * on the authenticated user, not the forced
     621             :          * user. See bug:
     622             :          *
     623             :          * https://bugzilla.samba.org/show_bug.cgi?id=9878
     624             :          */
     625             : 
     626       84996 :         status = check_user_share_access(conn,
     627       42498 :                                         session->global->auth_session_info,
     628             :                                         &conn->share_access,
     629             :                                         &conn->read_only);
     630       42498 :         if (!NT_STATUS_IS_OK(status)) {
     631           4 :                 goto err_root_exit;
     632             :         }
     633             : 
     634             :         /* Initialise VFS function pointers */
     635             : 
     636       42494 :         if (!smbd_vfs_init(conn)) {
     637           0 :                 DBG_ERR("vfs_init failed for service %s\n",
     638             :                         lp_const_servicename(snum));
     639           0 :                 status = NT_STATUS_BAD_NETWORK_NAME;
     640           0 :                 goto err_root_exit;
     641             :         }
     642             : 
     643             : /* ROOT Activities: */
     644             :         /* explicitly check widelinks here so that we can correctly warn
     645             :          * in the logs. */
     646       42494 :         widelinks_warning(snum);
     647             : 
     648             :         /*
     649             :          * Enforce the max connections parameter.
     650             :          */
     651             : 
     652       42494 :         if ((lp_max_connections(snum) > 0)
     653           0 :             && (count_current_connections(lp_const_servicename(SNUM(conn)), true) >=
     654           0 :                 lp_max_connections(snum))) {
     655             : 
     656           0 :                 DBG_WARNING("Max connections (%d) exceeded for %s\n",
     657             :                           lp_max_connections(snum),
     658             :                           lp_const_servicename(snum));
     659           0 :                 status = NT_STATUS_INSUFFICIENT_RESOURCES;
     660           0 :                 goto err_root_exit;
     661             :         }
     662             : 
     663             :         /* Invoke VFS make connection hook - this must be the first
     664             :            filesystem operation that we do. */
     665             : 
     666       42494 :         if (SMB_VFS_CONNECT(conn, lp_const_servicename(snum),
     667             :                             conn->session_info->unix_info->unix_name) < 0) {
     668           0 :                 DBG_WARNING("SMB_VFS_CONNECT for service '%s' at '%s' failed: %s\n",
     669             :                             lp_const_servicename(snum), conn->connectpath,
     670             :                             strerror(errno));
     671           0 :                 status = NT_STATUS_UNSUCCESSFUL;
     672           0 :                 goto err_root_exit;
     673             :         }
     674             : 
     675             :         /* Any error exit after here needs to call the disconnect hook. */
     676       42494 :         on_err_call_dis_hook = true;
     677             : 
     678       61350 :         if ((!conn->printer) && (!conn->ipc) &&
     679       18856 :             lp_change_notify()) {
     680             : 
     681       18708 :                 status = notify_init_sconn(sconn);
     682       18708 :                 if (!NT_STATUS_IS_OK(status)) {
     683           0 :                         goto err_root_exit;
     684             :                 }
     685             :         }
     686             : 
     687       42494 :         if (lp_kernel_oplocks(snum)) {
     688          17 :                 init_kernel_oplocks(conn->sconn);
     689             :         }
     690             : 
     691             :         /*
     692             :          * Fix compatibility issue pointed out by Volker.
     693             :          * We pass the conn->connectpath to the preexec
     694             :          * scripts as a parameter, so attempt to canonicalize
     695             :          * it here before calling the preexec scripts.
     696             :          * We ignore errors here, as it is possible that
     697             :          * the conn->connectpath doesn't exist yet and
     698             :          * the preexec scripts will create them.
     699             :          */
     700             : 
     701       42494 :         (void)canonicalize_connect_path(conn);
     702             : 
     703             :         /* Preexecs are done here as they might make the dir we are to ChDir
     704             :          * to below */
     705             :         /* execute any "root preexec = " line */
     706       42494 :         if (*lp_root_preexec(talloc_tos(), lp_sub, snum)) {
     707          50 :                 char *cmd = talloc_sub_full(talloc_tos(),
     708          10 :                                         lp_const_servicename(SNUM(conn)),
     709          10 :                                         conn->session_info->unix_info->unix_name,
     710          10 :                                         conn->connectpath,
     711          10 :                                         conn->session_info->unix_token->gid,
     712          10 :                                         conn->session_info->unix_info->sanitized_username,
     713          10 :                                         conn->session_info->info->domain_name,
     714          10 :                                         lp_root_preexec(talloc_tos(), lp_sub, snum));
     715          10 :                 DEBUG(5,("cmd=%s\n",cmd));
     716          10 :                 ret = smbrun(cmd, NULL, NULL);
     717          10 :                 TALLOC_FREE(cmd);
     718          10 :                 if (ret != 0 && lp_root_preexec_close(snum)) {
     719           0 :                         DEBUG(1,("root preexec gave %d - failing "
     720             :                                  "connection\n", ret));
     721           0 :                         status = NT_STATUS_ACCESS_DENIED;
     722           0 :                         goto err_root_exit;
     723             :                 }
     724             :         }
     725             : 
     726             : /* USER Activites: */
     727       42494 :         if (!change_to_user_and_service(conn, conn->vuid)) {
     728             :                 /* No point continuing if they fail the basic checks */
     729           0 :                 DEBUG(0,("Can't become connected user!\n"));
     730           0 :                 status = NT_STATUS_LOGON_FAILURE;
     731           0 :                 goto err_root_exit;
     732             :         }
     733             : 
     734       42494 :         effuid = geteuid();
     735       42494 :         effgid = getegid();
     736             : 
     737             :         /* Remember that a different vuid can connect later without these
     738             :          * checks... */
     739             : 
     740             :         /* Preexecs are done here as they might make the dir we are to ChDir
     741             :          * to below */
     742             : 
     743             :         /* execute any "preexec = " line */
     744       42494 :         if (*lp_preexec(talloc_tos(), lp_sub, snum)) {
     745           0 :                 char *cmd = talloc_sub_full(talloc_tos(),
     746           0 :                                         lp_const_servicename(SNUM(conn)),
     747           0 :                                         conn->session_info->unix_info->unix_name,
     748           0 :                                         conn->connectpath,
     749           0 :                                         conn->session_info->unix_token->gid,
     750           0 :                                         conn->session_info->unix_info->sanitized_username,
     751           0 :                                         conn->session_info->info->domain_name,
     752           0 :                                         lp_preexec(talloc_tos(), lp_sub, snum));
     753           0 :                 ret = smbrun(cmd, NULL, NULL);
     754           0 :                 TALLOC_FREE(cmd);
     755           0 :                 if (ret != 0 && lp_preexec_close(snum)) {
     756           0 :                         DEBUG(1,("preexec gave %d - failing connection\n",
     757             :                                  ret));
     758           0 :                         status = NT_STATUS_ACCESS_DENIED;
     759           0 :                         goto err_root_exit;
     760             :                 }
     761             :         }
     762             : 
     763             : #ifdef WITH_FAKE_KASERVER
     764             :         if (lp_afs_share(snum)) {
     765             :                 afs_login(conn);
     766             :         }
     767             : #endif
     768             : 
     769             :         /*
     770             :          * we've finished with the user stuff - go back to root
     771             :          * so the SMB_VFS_STAT call will only fail on path errors,
     772             :          * not permission problems.
     773             :          */
     774       42494 :         change_to_root_user();
     775             : /* ROOT Activites: */
     776             : 
     777             :         /*
     778             :          * Canonicalise the connect
     779             :          * path here to ensure we don't have any symlinks in the
     780             :          * connectpath. We will be checking all paths on this connection are
     781             :          * below this directory. We must do this after the VFS init as we
     782             :          * depend on the realpath() pointer in the vfs table. JRA.
     783             :          */
     784       42494 :         ok = canonicalize_connect_path(conn);
     785       42494 :         if (!ok) {
     786          24 :                 DBG_ERR("canonicalize_connect_path failed "
     787             :                 "for service %s, path %s\n",
     788             :                         lp_const_servicename(snum),
     789             :                         conn->connectpath);
     790          24 :                 status = NT_STATUS_BAD_NETWORK_NAME;
     791          24 :                 goto err_root_exit;
     792             :         }
     793             : 
     794             :         /* Add veto/hide lists */
     795       42470 :         if (!IS_IPC(conn) && !IS_PRINT(conn)) {
     796       18832 :                 set_namearray( &conn->veto_list,
     797       18832 :                                lp_veto_files(talloc_tos(), lp_sub, snum));
     798       18832 :                 set_namearray( &conn->hide_list,
     799       18832 :                                lp_hide_files(talloc_tos(), lp_sub, snum));
     800       18832 :                 set_namearray( &conn->veto_oplock_list,
     801       18832 :                                lp_veto_oplock_files(talloc_tos(), lp_sub, snum));
     802       18832 :                 set_namearray( &conn->aio_write_behind_list,
     803       18832 :                                 lp_aio_write_behind(talloc_tos(), lp_sub, snum));
     804             :         }
     805       42470 :         smb_fname_cpath = synthetic_smb_fname(talloc_tos(),
     806       42470 :                                         conn->connectpath,
     807             :                                         NULL,
     808             :                                         NULL,
     809             :                                         0,
     810             :                                         0);
     811       42470 :         if (smb_fname_cpath == NULL) {
     812           0 :                 status = NT_STATUS_NO_MEMORY;
     813           0 :                 goto err_root_exit;
     814             :         }
     815             : 
     816             :         /* win2000 does not check the permissions on the directory
     817             :            during the tree connect, instead relying on permission
     818             :            check during individual operations. To match this behaviour
     819             :            I have disabled this chdir check (tridge) */
     820             :         /* the alternative is just to check the directory exists */
     821             : 
     822       84940 :         if ((ret = SMB_VFS_STAT(conn, smb_fname_cpath)) != 0 ||
     823       42470 :             !S_ISDIR(smb_fname_cpath->st.st_ex_mode)) {
     824           0 :                 if (ret == 0 && !S_ISDIR(smb_fname_cpath->st.st_ex_mode)) {
     825           0 :                         DBG_ERR("'%s' is not a directory, when connecting to "
     826             :                                  "[%s]\n", conn->connectpath,
     827             :                                  lp_const_servicename(snum));
     828             :                 } else {
     829           0 :                         DBG_ERR("'%s' does not exist or permission denied "
     830             :                                  "when connecting to [%s] Error was %s\n",
     831             :                                  conn->connectpath,
     832             :                                  lp_const_servicename(snum),
     833             :                                  strerror(errno));
     834             :                 }
     835           0 :                 status = NT_STATUS_BAD_NETWORK_NAME;
     836           0 :                 goto err_root_exit;
     837             :         }
     838       42470 :         conn->base_share_dev = smb_fname_cpath->st.st_ex_dev;
     839             : 
     840             :         /* Figure out the characteristics of the underlying filesystem. This
     841             :          * assumes that all the filesystem mounted within a share path have
     842             :          * the same characteristics, which is likely but not guaranteed.
     843             :          */
     844             : 
     845       42470 :         conn->fs_capabilities = SMB_VFS_FS_CAPABILITIES(conn, &conn->ts_res);
     846             : 
     847             :         /*
     848             :          * Print out the 'connected as' stuff here as we need
     849             :          * to know the effective uid and gid we will be using
     850             :          * (at least initially).
     851             :          */
     852             : 
     853       42470 :         if( DEBUGLVL( IS_IPC(conn) ? 3 : 2 ) ) {
     854           0 :                 dbgtext( "%s (%s) ", get_remote_machine_name(),
     855           0 :                          tsocket_address_string(conn->sconn->remote_address,
     856             :                                                 talloc_tos()) );
     857           0 :                 dbgtext( "%s", srv_is_signing_active(xconn) ? "signed " : "");
     858           0 :                 dbgtext( "connect to service %s ",
     859             :                          lp_const_servicename(snum) );
     860           0 :                 dbgtext( "initially as user %s ",
     861           0 :                          conn->session_info->unix_info->unix_name );
     862           0 :                 dbgtext( "(uid=%d, gid=%d) ", (int)effuid, (int)effgid );
     863           0 :                 dbgtext( "(pid %d)\n", (int)getpid() );
     864             :         }
     865             : 
     866       42470 :         conn->tcon_done = true;
     867       42470 :         return NT_STATUS_OK;
     868             : 
     869          88 :   err_root_exit:
     870             : 
     871          88 :         TALLOC_FREE(smb_fname_cpath);
     872             :         /* We must exit this function as root. */
     873          94 :         if (geteuid() != 0) {
     874           0 :                 change_to_root_user();
     875             :         }
     876          94 :         if (on_err_call_dis_hook) {
     877             :                 /* Call VFS disconnect hook */
     878          24 :                 SMB_VFS_DISCONNECT(conn);
     879             :         }
     880          94 :         return status;
     881             : }
     882             : 
     883             : /****************************************************************************
     884             :  Make a connection to a service from SMB1. Internal interface.
     885             : ****************************************************************************/
     886             : 
     887        7566 : static connection_struct *make_connection_smb1(struct smb_request *req,
     888             :                                         NTTIME now,
     889             :                                         int snum,
     890             :                                         const char *pdev,
     891             :                                         NTSTATUS *pstatus)
     892             : {
     893        7566 :         const struct loadparm_substitution *lp_sub =
     894             :                 loadparm_s3_global_substitution();
     895             :         struct smbXsrv_tcon *tcon;
     896             :         NTSTATUS status;
     897             :         struct connection_struct *conn;
     898             : 
     899        7566 :         status = smb1srv_tcon_create(req->xconn, now, &tcon);
     900        7566 :         if (!NT_STATUS_IS_OK(status)) {
     901           0 :                 DEBUG(0,("make_connection_smb1: Couldn't find free tcon %s.\n",
     902             :                          nt_errstr(status)));
     903           0 :                 *pstatus = status;
     904           0 :                 return NULL;
     905             :         }
     906             : 
     907        7566 :         conn = conn_new(req->sconn);
     908        7566 :         if (!conn) {
     909           0 :                 TALLOC_FREE(tcon);
     910             : 
     911           0 :                 DEBUG(0,("make_connection_smb1: Couldn't find free connection.\n"));
     912           0 :                 *pstatus = NT_STATUS_INSUFFICIENT_RESOURCES;
     913           0 :                 return NULL;
     914             :         }
     915             : 
     916        7566 :         conn->cnum = tcon->global->tcon_wire_id;
     917        7566 :         conn->tcon = tcon;
     918             : 
     919        7566 :         *pstatus = make_connection_snum(req->xconn,
     920             :                                         conn,
     921             :                                         snum,
     922             :                                         req->session,
     923             :                                         pdev);
     924        7566 :         if (!NT_STATUS_IS_OK(*pstatus)) {
     925          58 :                 conn_free(conn);
     926          58 :                 TALLOC_FREE(tcon);
     927          52 :                 return NULL;
     928             :         }
     929             : 
     930        7508 :         tcon->global->share_name = lp_servicename(tcon->global, lp_sub, SNUM(conn));
     931        7508 :         if (tcon->global->share_name == NULL) {
     932           0 :                 conn_free(conn);
     933           0 :                 TALLOC_FREE(tcon);
     934           0 :                 *pstatus = NT_STATUS_NO_MEMORY;
     935           0 :                 return NULL;
     936             :         }
     937       14879 :         tcon->global->session_global_id =
     938       14879 :                 req->session->global->session_global_id;
     939             : 
     940        7508 :         tcon->compat = talloc_move(tcon, &conn);
     941        7508 :         tcon->status = NT_STATUS_OK;
     942             : 
     943        7508 :         *pstatus = smbXsrv_tcon_update(tcon);
     944        7508 :         if (!NT_STATUS_IS_OK(*pstatus)) {
     945           0 :                 TALLOC_FREE(tcon);
     946           0 :                 return NULL;
     947             :         }
     948             : 
     949        7508 :         return tcon->compat;
     950             : }
     951             : 
     952             : /****************************************************************************
     953             :  Make a connection to a service from SMB2. External SMB2 interface.
     954             :  We must set cnum before claiming connection.
     955             : ****************************************************************************/
     956             : 
     957       34998 : connection_struct *make_connection_smb2(struct smbd_smb2_request *req,
     958             :                                         struct smbXsrv_tcon *tcon,
     959             :                                         int snum,
     960             :                                         const char *pdev,
     961             :                                         NTSTATUS *pstatus)
     962             : {
     963       34998 :         struct smbd_server_connection *sconn = req->sconn;
     964       34998 :         connection_struct *conn = conn_new(sconn);
     965       34998 :         if (!conn) {
     966           0 :                 DEBUG(0,("make_connection_smb2: Couldn't find free connection.\n"));
     967           0 :                 *pstatus = NT_STATUS_INSUFFICIENT_RESOURCES;
     968           0 :                 return NULL;
     969             :         }
     970             : 
     971       34998 :         conn->cnum = tcon->global->tcon_wire_id;
     972       34998 :         conn->tcon = tcon;
     973             : 
     974       34998 :         *pstatus = make_connection_snum(req->xconn,
     975             :                                         conn,
     976             :                                         snum,
     977             :                                         req->session,
     978             :                                         pdev);
     979       34998 :         if (!NT_STATUS_IS_OK(*pstatus)) {
     980          36 :                 conn_free(conn);
     981          36 :                 return NULL;
     982             :         }
     983       34572 :         return conn;
     984             : }
     985             : 
     986             : /****************************************************************************
     987             :  Make a connection to a service. External SMB1 interface.
     988             :  *
     989             :  * @param service 
     990             : ****************************************************************************/
     991             : 
     992        7574 : connection_struct *make_connection(struct smb_request *req,
     993             :                                    NTTIME now,
     994             :                                    const char *service_in,
     995             :                                    const char *pdev, uint64_t vuid,
     996             :                                    NTSTATUS *status)
     997             : {
     998        7574 :         struct smbd_server_connection *sconn = req->sconn;
     999        7574 :         struct smbXsrv_session *session = req->session;
    1000        7574 :         const struct loadparm_substitution *lp_sub =
    1001             :                 loadparm_s3_global_substitution();
    1002             :         uid_t euid;
    1003        7574 :         char *service = NULL;
    1004             :         fstring dev;
    1005        7574 :         int snum = -1;
    1006             : 
    1007        7574 :         fstrcpy(dev, pdev);
    1008             : 
    1009             :         /* This must ONLY BE CALLED AS ROOT. As it exits this function as
    1010             :          * root. */
    1011        7574 :         if (!non_root_mode() && (euid = geteuid()) != 0) {
    1012           0 :                 DEBUG(0,("make_connection: PANIC ERROR. Called as nonroot "
    1013             :                          "(%u)\n", (unsigned int)euid ));
    1014           0 :                 smb_panic("make_connection: PANIC ERROR. Called as nonroot\n");
    1015             :         }
    1016             : 
    1017        7574 :         if (conn_num_open(sconn) > 2047) {
    1018           0 :                 *status = NT_STATUS_INSUFF_SERVER_RESOURCES;
    1019           0 :                 return NULL;
    1020             :         }
    1021             : 
    1022        7574 :         if (session == NULL) {
    1023           0 :                 DEBUG(1,("make_connection: refusing to connect with "
    1024             :                          "no session setup\n"));
    1025           0 :                 *status = NT_STATUS_ACCESS_DENIED;
    1026           0 :                 return NULL;
    1027             :         }
    1028             : 
    1029             :         /* Logic to try and connect to the correct [homes] share, preferably
    1030             :            without too many getpwnam() lookups.  This is particulary nasty for
    1031             :            winbind usernames, where the share name isn't the same as unix
    1032             :            username.
    1033             :         */
    1034             : 
    1035        7574 :         if (strequal(service_in,HOMES_NAME)) {
    1036           0 :                 if (session->homes_snum == -1) {
    1037           0 :                         DEBUG(2, ("[homes] share not available for "
    1038             :                                   "this user because it was not found "
    1039             :                                   "or created at session setup "
    1040             :                                   "time\n"));
    1041           0 :                         *status = NT_STATUS_BAD_NETWORK_NAME;
    1042           0 :                         return NULL;
    1043             :                 }
    1044           0 :                 DEBUG(5, ("making a connection to [homes] service "
    1045             :                           "created at session setup time\n"));
    1046           0 :                 return make_connection_smb1(req, now,
    1047           0 :                                             session->homes_snum,
    1048             :                                             dev, status);
    1049        7574 :         } else if ((session->homes_snum != -1)
    1050        4400 :                    && strequal(service_in,
    1051        4400 :                                lp_const_servicename(session->homes_snum))) {
    1052           0 :                 DEBUG(5, ("making a connection to 'homes' service [%s] "
    1053             :                           "created at session setup time\n", service_in));
    1054           0 :                 return make_connection_smb1(req, now,
    1055           0 :                                             session->homes_snum,
    1056             :                                             dev, status);
    1057             :         }
    1058             : 
    1059        7574 :         service = talloc_strdup(talloc_tos(), service_in);
    1060        7574 :         if (!service) {
    1061           0 :                 *status = NT_STATUS_NO_MEMORY;
    1062           0 :                 return NULL;
    1063             :         }
    1064             : 
    1065        7574 :         if (!strlower_m(service)) {
    1066           0 :                 DEBUG(2, ("strlower_m %s failed\n", service));
    1067           0 :                 *status = NT_STATUS_INVALID_PARAMETER;
    1068           0 :                 return NULL;
    1069             :         }
    1070             : 
    1071        7574 :         snum = find_service(talloc_tos(), service, &service);
    1072        7574 :         if (!service) {
    1073           0 :                 *status = NT_STATUS_NO_MEMORY;
    1074           0 :                 return NULL;
    1075             :         }
    1076             : 
    1077        7574 :         if (snum < 0) {
    1078          16 :                 if (strequal(service,"IPC$") ||
    1079           8 :                     (lp_enable_asu_support() && strequal(service,"ADMIN$"))) {
    1080           0 :                         DEBUG(3,("refusing IPC connection to %s\n", service));
    1081           0 :                         *status = NT_STATUS_ACCESS_DENIED;
    1082           0 :                         return NULL;
    1083             :                 }
    1084             : 
    1085           8 :                 DEBUG(3,("%s (%s) couldn't find service %s\n",
    1086             :                         get_remote_machine_name(),
    1087             :                         tsocket_address_string(
    1088             :                                 sconn->remote_address, talloc_tos()),
    1089             :                         service));
    1090           8 :                 *status = NT_STATUS_BAD_NETWORK_NAME;
    1091           8 :                 return NULL;
    1092             :         }
    1093             : 
    1094             :         /* Handle non-Dfs clients attempting connections to msdfs proxy */
    1095        7566 :         if (lp_host_msdfs() && (*lp_msdfs_proxy(talloc_tos(), lp_sub, snum) != '\0'))  {
    1096           0 :                 DEBUG(3, ("refusing connection to dfs proxy share '%s' "
    1097             :                           "(pointing to %s)\n", 
    1098             :                         service, lp_msdfs_proxy(talloc_tos(), lp_sub, snum)));
    1099           0 :                 *status = NT_STATUS_BAD_NETWORK_NAME;
    1100           0 :                 return NULL;
    1101             :         }
    1102             : 
    1103        7566 :         DEBUG(5, ("making a connection to 'normal' service %s\n", service));
    1104             : 
    1105        7566 :         return make_connection_smb1(req, now, snum,
    1106             :                                     dev, status);
    1107             : }
    1108             : 
    1109             : /****************************************************************************
    1110             :  Close a cnum.
    1111             : ****************************************************************************/
    1112             : 
    1113       42420 : void close_cnum(connection_struct *conn, uint64_t vuid)
    1114             : {
    1115       42420 :         char rootpath[2] = { '/', '\0'};
    1116       42420 :         struct smb_filename root_fname = { .base_name = rootpath };
    1117       42420 :         const struct loadparm_substitution *lp_sub =
    1118             :                 loadparm_s3_global_substitution();
    1119             : 
    1120       42420 :         file_close_conn(conn);
    1121             : 
    1122       42420 :         change_to_root_user();
    1123             : 
    1124       42420 :         DEBUG(IS_IPC(conn)?3:2, ("%s (%s) closed connection to service %s\n",
    1125             :                                  get_remote_machine_name(),
    1126             :                                  tsocket_address_string(conn->sconn->remote_address,
    1127             :                                                         talloc_tos()),
    1128             :                                  lp_const_servicename(SNUM(conn))));
    1129             : 
    1130             :         /* make sure we leave the directory available for unmount */
    1131       42420 :         vfs_ChDir(conn, &root_fname);
    1132             : 
    1133             :         /* Call VFS disconnect hook */
    1134       42420 :         SMB_VFS_DISCONNECT(conn);
    1135             : 
    1136             :         /* execute any "postexec = " line */
    1137       42420 :         if (*lp_postexec(talloc_tos(), lp_sub, SNUM(conn)) &&
    1138           0 :             change_to_user_and_service(conn, vuid))  {
    1139           0 :                 char *cmd = talloc_sub_full(talloc_tos(),
    1140           0 :                                         lp_const_servicename(SNUM(conn)),
    1141           0 :                                         conn->session_info->unix_info->unix_name,
    1142           0 :                                         conn->connectpath,
    1143           0 :                                         conn->session_info->unix_token->gid,
    1144           0 :                                         conn->session_info->unix_info->sanitized_username,
    1145           0 :                                         conn->session_info->info->domain_name,
    1146           0 :                                         lp_postexec(talloc_tos(), lp_sub, SNUM(conn)));
    1147           0 :                 smbrun(cmd, NULL, NULL);
    1148           0 :                 TALLOC_FREE(cmd);
    1149           0 :                 change_to_root_user();
    1150             :         }
    1151             : 
    1152       42420 :         change_to_root_user();
    1153             :         /* execute any "root postexec = " line */
    1154       42420 :         if (*lp_root_postexec(talloc_tos(), lp_sub, SNUM(conn)))  {
    1155           0 :                 char *cmd = talloc_sub_full(talloc_tos(),
    1156           0 :                                         lp_const_servicename(SNUM(conn)),
    1157           0 :                                         conn->session_info->unix_info->unix_name,
    1158           0 :                                         conn->connectpath,
    1159           0 :                                         conn->session_info->unix_token->gid,
    1160           0 :                                         conn->session_info->unix_info->sanitized_username,
    1161           0 :                                         conn->session_info->info->domain_name,
    1162           0 :                                         lp_root_postexec(talloc_tos(), lp_sub, SNUM(conn)));
    1163           0 :                 smbrun(cmd, NULL, NULL);
    1164           0 :                 TALLOC_FREE(cmd);
    1165             :         }
    1166             : 
    1167       42420 :         conn_free(conn);
    1168       42420 : }

Generated by: LCOV version 1.13