1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #include <sys/types.h> 27 #include <errno.h> 28 #include <synch.h> 29 #include <stdio.h> 30 #include <stdlib.h> 31 #include <unistd.h> 32 #include <string.h> 33 #include <strings.h> 34 #include <syslog.h> 35 #include <fcntl.h> 36 #include <bsm/adt.h> 37 #include <bsm/adt_event.h> 38 #include <bsm/audit_uevents.h> 39 #include "smbd.h" 40 41 42 /* 43 * An audit session is established at user logon and terminated at user 44 * logoff. 45 * 46 * SMB audit handles are allocated when users logon (SmbSessionSetupX) 47 * and deallocted when a user logs off (SmbLogoffX). Each time an SMB 48 * audit handle is allocated it is added to a global list. 49 */ 50 typedef struct smb_audit { 51 struct smb_audit *sa_next; 52 adt_session_data_t *sa_handle; 53 uid_t sa_uid; 54 gid_t sa_gid; 55 uint32_t sa_audit_sid; 56 uint32_t sa_refcnt; 57 char *sa_domain; 58 char *sa_username; 59 } smb_audit_t; 60 61 static smb_audit_t *smbd_audit_list; 62 static mutex_t smbd_audit_lock; 63 64 /* 65 * Unique identifier for audit sessions in the audit list. 66 * Used to lookup an audit session on logoff. 67 */ 68 static uint32_t smbd_audit_sid; 69 70 static void smbd_audit_link(smb_audit_t *); 71 static smb_audit_t *smbd_audit_unlink(uint32_t); 72 73 74 /* 75 * Invoked at user logon due to SmbSessionSetupX. Authenticate the 76 * user, start an audit session and audit the event. 77 */ 78 smb_token_t * 79 smbd_user_auth_logon(netr_client_t *clnt) 80 { 81 smb_token_t *token; 82 smb_audit_t *entry; 83 adt_session_data_t *ah; 84 adt_event_data_t *event; 85 au_tid_addr_t termid; 86 char sidbuf[SMB_SID_STRSZ]; 87 char *username; 88 char *domain; 89 uid_t uid; 90 gid_t gid; 91 char *sid; 92 int status; 93 int retval; 94 95 if ((token = smb_logon(clnt)) == NULL) { 96 uid = ADT_NO_ATTRIB; 97 gid = ADT_NO_ATTRIB; 98 sid = NT_NULL_SIDSTR; 99 username = clnt->real_username; 100 domain = clnt->real_domain; 101 status = ADT_FAILURE; 102 retval = ADT_FAIL_VALUE_AUTH; 103 } else { 104 uid = token->tkn_user.i_id; 105 gid = token->tkn_primary_grp.i_id; 106 smb_sid_tostr(token->tkn_user.i_sid, sidbuf); 107 sid = sidbuf; 108 username = token->tkn_account_name; 109 domain = token->tkn_domain_name; 110 status = ADT_SUCCESS; 111 retval = ADT_SUCCESS; 112 } 113 114 if (adt_start_session(&ah, NULL, 0)) { 115 syslog(LOG_AUTH | LOG_ALERT, "adt_start_session: %m"); 116 smb_token_destroy(token); 117 return (NULL); 118 } 119 120 if ((event = adt_alloc_event(ah, ADT_smbd_session)) == NULL) { 121 syslog(LOG_AUTH | LOG_ALERT, 122 "adt_alloc_event(ADT_smbd_session): %m"); 123 (void) adt_end_session(ah); 124 smb_token_destroy(token); 125 return (NULL); 126 } 127 128 (void) memset(&termid, 0, sizeof (au_tid_addr_t)); 129 termid.at_port = clnt->local_port; 130 131 if (clnt->ipaddr.a_family == AF_INET) { 132 termid.at_addr[0] = clnt->ipaddr.a_ipv4; 133 termid.at_type = AU_IPv4; 134 } else { 135 bcopy(&clnt->ipaddr.a_ip, termid.at_addr, IPV6_ADDR_LEN); 136 termid.at_type = AU_IPv6; 137 } 138 adt_set_termid(ah, &termid); 139 140 if (adt_set_user(ah, uid, gid, uid, gid, NULL, ADT_NEW)) { 141 syslog(LOG_AUTH | LOG_ALERT, "adt_set_user: %m"); 142 adt_free_event(event); 143 (void) adt_end_session(ah); 144 smb_token_destroy(token); 145 return (NULL); 146 } 147 148 event->adt_smbd_session.domain = domain; 149 event->adt_smbd_session.username = username; 150 event->adt_smbd_session.sid = sid; 151 152 if (adt_put_event(event, status, retval)) 153 syslog(LOG_AUTH | LOG_ALERT, "adt_put_event: %m"); 154 155 adt_free_event(event); 156 157 if (token) { 158 if ((entry = malloc(sizeof (smb_audit_t))) == NULL) { 159 syslog(LOG_ERR, "smbd_user_auth_logon: %m"); 160 (void) adt_end_session(ah); 161 smb_token_destroy(token); 162 return (NULL); 163 } 164 165 entry->sa_handle = ah; 166 entry->sa_uid = uid; 167 entry->sa_gid = gid; 168 entry->sa_username = strdup(username); 169 entry->sa_domain = strdup(domain); 170 171 smb_autohome_add(entry->sa_username); 172 smbd_audit_link(entry); 173 token->tkn_audit_sid = entry->sa_audit_sid; 174 } 175 176 return (token); 177 } 178 179 /* 180 * Logon due to a subsequent SmbSessionSetupX on an existing session. 181 * The user was authenticated during the initial session setup. 182 */ 183 void 184 smbd_user_nonauth_logon(uint32_t audit_sid) 185 { 186 smb_audit_t *entry; 187 188 (void) mutex_lock(&smbd_audit_lock); 189 entry = smbd_audit_list; 190 191 while (entry) { 192 if (entry->sa_audit_sid == audit_sid) { 193 ++entry->sa_refcnt; 194 break; 195 } 196 197 entry = entry->sa_next; 198 } 199 200 (void) mutex_unlock(&smbd_audit_lock); 201 } 202 203 /* 204 * Invoked at user logoff due to SmbLogoffX. If this is the final 205 * logoff for this user on the session, audit the event and terminate 206 * the audit session. 207 */ 208 void 209 smbd_user_auth_logoff(uint32_t audit_sid) 210 { 211 smb_audit_t *entry; 212 adt_session_data_t *ah; 213 adt_event_data_t *event; 214 215 if ((entry = smbd_audit_unlink(audit_sid)) == NULL) 216 return; 217 218 smb_autohome_remove(entry->sa_username); 219 220 ah = entry->sa_handle; 221 222 if ((event = adt_alloc_event(ah, ADT_smbd_logoff)) == NULL) { 223 syslog(LOG_AUTH | LOG_ALERT, 224 "adt_alloc_event(ADT_smbd_logoff): %m"); 225 } else { 226 event->adt_smbd_logoff.domain = entry->sa_domain; 227 event->adt_smbd_logoff.username = entry->sa_username; 228 229 if (adt_put_event(event, ADT_SUCCESS, ADT_SUCCESS)) 230 syslog(LOG_AUTH | LOG_ALERT, "adt_put_event: %m"); 231 232 adt_free_event(event); 233 } 234 235 (void) adt_end_session(ah); 236 237 free(entry->sa_username); 238 free(entry->sa_domain); 239 free(entry); 240 } 241 242 /* 243 * Allocate an id and link an audit handle onto the global list. 244 */ 245 static void 246 smbd_audit_link(smb_audit_t *entry) 247 { 248 (void) mutex_lock(&smbd_audit_lock); 249 250 do { 251 ++smbd_audit_sid; 252 } while ((smbd_audit_sid == 0) || (smbd_audit_sid == (uint32_t)-1)); 253 254 entry->sa_audit_sid = smbd_audit_sid; 255 entry->sa_refcnt = 1; 256 entry->sa_next = smbd_audit_list; 257 smbd_audit_list = entry; 258 259 (void) mutex_unlock(&smbd_audit_lock); 260 } 261 262 /* 263 * Unlink an audit handle. If the reference count reaches 0, the entry 264 * is removed from the list and returned. Otherwise the entry remains 265 * on the list and a null pointer is returned. 266 */ 267 static smb_audit_t * 268 smbd_audit_unlink(uint32_t audit_sid) 269 { 270 smb_audit_t *entry; 271 smb_audit_t **ppe; 272 273 (void) mutex_lock(&smbd_audit_lock); 274 ppe = &smbd_audit_list; 275 276 while (*ppe) { 277 entry = *ppe; 278 279 if (entry->sa_audit_sid == audit_sid) { 280 if (entry->sa_refcnt == 0) 281 break; 282 283 if ((--entry->sa_refcnt) != 0) 284 break; 285 286 *ppe = entry->sa_next; 287 (void) mutex_unlock(&smbd_audit_lock); 288 return (entry); 289 } 290 291 ppe = &(*ppe)->sa_next; 292 } 293 294 (void) mutex_unlock(&smbd_audit_lock); 295 return (NULL); 296 } 297