1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved. 23 * Copyright 2019 Nexenta by DDN, Inc. All rights reserved. 24 * Copyright (c) 2016 by Delphix. All rights reserved. 25 */ 26 27 /* 28 * General Structures Layout 29 * ------------------------- 30 * 31 * This is a simplified diagram showing the relationship between most of the 32 * main structures. 33 * 34 * +-------------------+ 35 * | SMB_INFO | 36 * +-------------------+ 37 * | 38 * | 39 * v 40 * +-------------------+ +-------------------+ +-------------------+ 41 * | SESSION |<----->| SESSION |......| SESSION | 42 * +-------------------+ +-------------------+ +-------------------+ 43 * | | 44 * | | 45 * | v 46 * | +-------------------+ +-------------------+ +-------------------+ 47 * | | USER |<--->| USER |...| USER | 48 * | +-------------------+ +-------------------+ +-------------------+ 49 * | 50 * | 51 * v 52 * +-------------------+ +-------------------+ +-------------------+ 53 * | TREE |<----->| TREE |......| TREE | 54 * +-------------------+ +-------------------+ +-------------------+ 55 * | | 56 * | | 57 * | v 58 * | +-------+ +-------+ +-------+ 59 * | | OFILE |<----->| OFILE |......| OFILE | 60 * | +-------+ +-------+ +-------+ 61 * | 62 * | 63 * v 64 * +-------+ +------+ +------+ 65 * | ODIR |<----->| ODIR |......| ODIR | 66 * +-------+ +------+ +------+ 67 * 68 * 69 * User State Machine 70 * ------------------ 71 * 72 * 73 * | T0: Creation/Allocation 74 * | (1st session setup) 75 * v 76 * +-----------------------------+ 77 * | SMB_USER_STATE_LOGGING_ON |<----------+ 78 * +-----------------------------+ addl. session setup 79 * | | (more proc. required) 80 * | T2 | ^ 81 * | | | T1: (cont.) 82 * | +------->-------? 83 * v | T3: (fail) 84 * +-----------------------------+ v 85 * | SMB_USER_STATE_LOGGED_ON | (logged off) 86 * +-----------------------------+ 87 * | 88 * | T4 89 * | 90 * v 91 * +-----------------------------+ 92 * | SMB_USER_STATE_LOGGING_OFF | 93 * +-----------------------------+ 94 * | 95 * | T5 96 * | 97 * v 98 * +-----------------------------+ T6 99 * | SMB_USER_STATE_LOGGED_OFF |----------> Deletion/Free 100 * +-----------------------------+ 101 * 102 * SMB_USER_STATE_LOGGING_ON 103 * 104 * While in this state: 105 * - The user is in the list of users for their session. 106 * - References will be given out ONLY for session setup. 107 * - This user can not access anything yet. 108 * 109 * SMB_USER_STATE_LOGGED_ON 110 * 111 * While in this state: 112 * - The user is in the list of users for their session. 113 * - References will be given out if the user is looked up. 114 * - The user can access files and pipes. 115 * 116 * SMB_USER_STATE_LOGGING_OFF 117 * 118 * While in this state: 119 * - The user is in the list of users for their session. 120 * - References will not be given out if the user is looked up. 121 * - The trees the user connected are being disconnected. 122 * - The resources associated with the user remain. 123 * 124 * SMB_USER_STATE_LOGGED_OFF 125 * 126 * While in this state: 127 * - The user is queued in the list of users of their session. 128 * - References will not be given out if the user is looked up. 129 * - The user has no more trees connected. 130 * - The resources associated with the user remain. 131 * 132 * Transition T0 133 * 134 * First request in an SMB Session Setup sequence creates a 135 * new user object and adds it to the list of users for 136 * this session. User UID is assigned and returned. 137 * 138 * Transition T1 139 * 140 * Subsequent SMB Session Setup requests (on the same UID 141 * assigned in T0) update the state of this user object, 142 * communicating with smbd for the crypto work. 143 * 144 * Transition T2 145 * 146 * If the SMB Session Setup sequence is successful, T2 147 * makes the new user object available for requests. 148 * 149 * Transition T3 150 * 151 * If an Session Setup request gets an error other than 152 * the expected "more processing required", then T3 153 * leads to state "LOGGED_OFF" and then tear-down of the 154 * partially constructed user. 155 * 156 * Transition T4 157 * 158 * Normal SMB User Logoff request, or session tear-down. 159 * 160 * Transition T5 161 * 162 * This transition occurs in smb_user_release(). The resources associated 163 * with the user are deleted as well as the user. For the transition to 164 * occur, the user must be in the SMB_USER_STATE_LOGGED_OFF state and the 165 * reference count be zero. 166 * 167 * Comments 168 * -------- 169 * 170 * The state machine of the user structures is controlled by 3 elements: 171 * - The list of users of the session they belong to. 172 * - The mutex embedded in the structure itself. 173 * - The reference count. 174 * 175 * There's a mutex embedded in the user structure used to protect its fields 176 * and there's a lock embedded in the list of users of a session. To 177 * increment or to decrement the reference count the mutex must be entered. 178 * To insert the user into the list of users of the session and to remove 179 * the user from it, the lock must be entered in RW_WRITER mode. 180 * 181 * Rules of access to a user structure: 182 * 183 * 1) In order to avoid deadlocks, when both (mutex and lock of the session 184 * list) have to be entered, the lock must be entered first. Additionally, 185 * one may NOT flush the deleteq of either the tree list or the ofile list 186 * while the user mutex is held. 187 * 188 * 2) All actions applied to a user require a reference count. 189 * 190 * 3) There are 2 ways of getting a reference count. One is when the user 191 * logs in. The other when the user is looked up. 192 * 193 * It should be noted that the reference count of a user registers the 194 * number of references to the user in other structures (such as an smb 195 * request). The reference count is not incremented in these 2 instances: 196 * 197 * 1) The user is logged in. An user is anchored by their state. If there's 198 * no activity involving a user currently logged in, the reference 199 * count of that user is zero. 200 * 201 * 2) The user is queued in the list of users of the session. The fact of 202 * being queued in that list is NOT registered by incrementing the 203 * reference count. 204 */ 205 #include <sys/types.h> 206 #include <sys/sid.h> 207 #include <sys/priv_names.h> 208 #include <smbsrv/smb_kproto.h> 209 #include <smbsrv/smb_door.h> 210 211 #define ADMINISTRATORS_SID "S-1-5-32-544" 212 213 /* Don't leak object addresses */ 214 #define SMB_USER_SSNID(u) \ 215 ((uintptr_t)&smb_cache_user ^ (uintptr_t)(u)) 216 217 static void smb_user_delete(void *); 218 static int smb_user_enum_private(smb_user_t *, smb_svcenum_t *); 219 static void smb_user_auth_logoff(smb_user_t *); 220 static void smb_user_logoff_tq(void *); 221 222 /* 223 * Create a new user. 224 * 225 * For SMB2 and later, session IDs (u_ssnid) need to be unique among all 226 * current and "recent" sessions. The session ID is derived from the 227 * address of the smb_user object (obscured by XOR with a constant). 228 * This adds a 3-bit generation number in the low bits, incremented 229 * when we allocate an smb_user_t from its kmem cache, so it can't 230 * be confused with a (recent) previous incarnation of this object. 231 */ 232 smb_user_t * 233 smb_user_new(smb_session_t *session) 234 { 235 smb_user_t *user; 236 uint_t gen; // generation (low 3 bits of ssnid) 237 uint32_t ucount; 238 239 ASSERT(session); 240 ASSERT(session->s_magic == SMB_SESSION_MAGIC); 241 242 user = kmem_cache_alloc(smb_cache_user, KM_SLEEP); 243 gen = (user->u_ssnid + 1) & 7; 244 bzero(user, sizeof (smb_user_t)); 245 246 user->u_refcnt = 1; 247 user->u_session = session; 248 user->u_server = session->s_server; 249 user->u_logon_time = gethrestime_sec(); 250 251 if (smb_idpool_alloc(&session->s_uid_pool, &user->u_uid)) 252 goto errout; 253 user->u_ssnid = SMB_USER_SSNID(user) + gen; 254 255 mutex_init(&user->u_mutex, NULL, MUTEX_DEFAULT, NULL); 256 user->u_state = SMB_USER_STATE_LOGGING_ON; 257 user->u_magic = SMB_USER_MAGIC; 258 259 smb_llist_enter(&session->s_user_list, RW_WRITER); 260 ucount = smb_llist_get_count(&session->s_user_list); 261 smb_llist_insert_tail(&session->s_user_list, user); 262 smb_llist_exit(&session->s_user_list); 263 smb_server_inc_users(session->s_server); 264 265 /* 266 * If we added the first user to the session, cancel the 267 * timeout that was started in smb_session_receiver(). 268 */ 269 if (ucount == 0) { 270 timeout_id_t tmo = NULL; 271 272 smb_rwx_rwenter(&session->s_lock, RW_WRITER); 273 tmo = session->s_auth_tmo; 274 session->s_auth_tmo = NULL; 275 smb_rwx_rwexit(&session->s_lock); 276 277 if (tmo != NULL) 278 (void) untimeout(tmo); 279 } 280 281 return (user); 282 283 errout: 284 if (user->u_uid != 0) 285 smb_idpool_free(&session->s_uid_pool, user->u_uid); 286 kmem_cache_free(smb_cache_user, user); 287 return (NULL); 288 } 289 290 /* 291 * Fill in the details of a user, meaning a transition 292 * from state LOGGING_ON to state LOGGED_ON. 293 */ 294 int 295 smb_user_logon( 296 smb_user_t *user, 297 cred_t *cr, 298 char *domain_name, 299 char *account_name, 300 uint32_t flags, 301 uint32_t privileges, 302 uint32_t audit_sid) 303 { 304 ksocket_t authsock = NULL; 305 timeout_id_t tmo = NULL; 306 307 ASSERT(user->u_magic == SMB_USER_MAGIC); 308 ASSERT(cr); 309 ASSERT(account_name); 310 ASSERT(domain_name); 311 312 mutex_enter(&user->u_mutex); 313 314 if (user->u_state != SMB_USER_STATE_LOGGING_ON) { 315 mutex_exit(&user->u_mutex); 316 return (-1); 317 } 318 319 /* 320 * In the transition from LOGGING_ON to LOGGED_ON, 321 * we always have an auth. socket to close. 322 */ 323 authsock = user->u_authsock; 324 user->u_authsock = NULL; 325 tmo = user->u_auth_tmo; 326 user->u_auth_tmo = NULL; 327 328 user->u_state = SMB_USER_STATE_LOGGED_ON; 329 user->u_flags = flags; 330 user->u_name_len = strlen(account_name) + 1; 331 user->u_domain_len = strlen(domain_name) + 1; 332 user->u_name = smb_mem_strdup(account_name); 333 user->u_domain = smb_mem_strdup(domain_name); 334 user->u_audit_sid = audit_sid; 335 336 smb_user_setcred(user, cr, privileges); 337 338 mutex_exit(&user->u_mutex); 339 340 /* Timeout callback takes u_mutex. See untimeout(9f) */ 341 if (tmo != NULL) 342 (void) untimeout(tmo); 343 344 /* This close can block, so not under the mutex. */ 345 if (authsock != NULL) 346 smb_authsock_close(user, authsock); 347 348 return (0); 349 } 350 351 /* 352 * smb_user_logoff 353 * 354 * Change the user state to "logging off" and disconnect trees. 355 * The user list must not be entered or modified here. 356 * 357 * We remain in state "logging off" until the last ref. is gone, 358 * then smb_user_release takes us to state "logged off". 359 */ 360 void 361 smb_user_logoff( 362 smb_user_t *user) 363 { 364 ksocket_t authsock = NULL; 365 timeout_id_t tmo = NULL; 366 367 ASSERT(user->u_magic == SMB_USER_MAGIC); 368 369 mutex_enter(&user->u_mutex); 370 ASSERT(user->u_refcnt); 371 switch (user->u_state) { 372 case SMB_USER_STATE_LOGGING_ON: 373 authsock = user->u_authsock; 374 user->u_authsock = NULL; 375 tmo = user->u_auth_tmo; 376 user->u_auth_tmo = NULL; 377 user->u_state = SMB_USER_STATE_LOGGING_OFF; 378 mutex_exit(&user->u_mutex); 379 380 /* Timeout callback takes u_mutex. See untimeout(9f) */ 381 if (tmo != NULL) 382 (void) untimeout(tmo); 383 /* This close can block, so not under the mutex. */ 384 if (authsock != NULL) 385 smb_authsock_close(user, authsock); 386 break; 387 388 case SMB_USER_STATE_LOGGED_ON: 389 /* 390 * The user is moved into a state indicating that the log off 391 * process has started. 392 */ 393 user->u_state = SMB_USER_STATE_LOGGING_OFF; 394 mutex_exit(&user->u_mutex); 395 smb_session_disconnect_owned_trees(user->u_session, user); 396 smb_user_auth_logoff(user); 397 break; 398 399 case SMB_USER_STATE_LOGGED_OFF: 400 case SMB_USER_STATE_LOGGING_OFF: 401 mutex_exit(&user->u_mutex); 402 break; 403 404 default: 405 ASSERT(0); 406 mutex_exit(&user->u_mutex); 407 break; 408 } 409 } 410 411 /* 412 * Take a reference on a user. Do not return a reference unless the user is in 413 * the logged-in state. 414 */ 415 boolean_t 416 smb_user_hold(smb_user_t *user) 417 { 418 SMB_USER_VALID(user); 419 420 mutex_enter(&user->u_mutex); 421 422 if (user->u_state == SMB_USER_STATE_LOGGED_ON) { 423 user->u_refcnt++; 424 mutex_exit(&user->u_mutex); 425 return (B_TRUE); 426 } 427 428 mutex_exit(&user->u_mutex); 429 return (B_FALSE); 430 } 431 432 /* 433 * Unconditionally take a reference on a user. 434 */ 435 void 436 smb_user_hold_internal(smb_user_t *user) 437 { 438 SMB_USER_VALID(user); 439 440 mutex_enter(&user->u_mutex); 441 user->u_refcnt++; 442 mutex_exit(&user->u_mutex); 443 } 444 445 /* 446 * Release a reference on a user. If the reference count falls to 447 * zero and the user has logged off, post the object for deletion. 448 * Object deletion is deferred to avoid modifying a list while an 449 * iteration may be in progress. 450 */ 451 void 452 smb_user_release( 453 smb_user_t *user) 454 { 455 smb_session_t *ssn = user->u_session; 456 457 SMB_USER_VALID(user); 458 459 /* flush the tree list delete queue */ 460 smb_llist_flush(&ssn->s_tree_list); 461 462 mutex_enter(&user->u_mutex); 463 ASSERT(user->u_refcnt); 464 user->u_refcnt--; 465 466 switch (user->u_state) { 467 case SMB_USER_STATE_LOGGING_OFF: 468 if (user->u_refcnt == 0) { 469 smb_session_t *ssn = user->u_session; 470 user->u_state = SMB_USER_STATE_LOGGED_OFF; 471 smb_llist_post(&ssn->s_user_list, user, 472 smb_user_delete); 473 } 474 break; 475 476 case SMB_USER_STATE_LOGGING_ON: 477 case SMB_USER_STATE_LOGGED_ON: 478 break; 479 480 case SMB_USER_STATE_LOGGED_OFF: 481 default: 482 ASSERT(0); 483 break; 484 } 485 mutex_exit(&user->u_mutex); 486 } 487 488 /* 489 * Timeout handler for user logons that stay too long in 490 * state SMB_USER_STATE_LOGGING_ON. This is setup by a 491 * timeout call in smb_authsock_open, and called in a 492 * callout thread, so schedule a taskq job to do the 493 * real work of logging off this user. 494 */ 495 void 496 smb_user_auth_tmo(void *arg) 497 { 498 smb_user_t *user = arg; 499 smb_request_t *sr; 500 501 SMB_USER_VALID(user); 502 503 /* 504 * If we can't allocate a request, it means the 505 * session is being torn down, so nothing to do. 506 */ 507 sr = smb_request_alloc(user->u_session, 0); 508 if (sr == NULL) 509 return; 510 511 /* 512 * Check user state, and take a hold if it's 513 * still logging on. If not, we're done. 514 */ 515 mutex_enter(&user->u_mutex); 516 if (user->u_state != SMB_USER_STATE_LOGGING_ON) { 517 mutex_exit(&user->u_mutex); 518 smb_request_free(sr); 519 return; 520 } 521 /* smb_user_hold_internal */ 522 user->u_refcnt++; 523 mutex_exit(&user->u_mutex); 524 525 /* 526 * The user hold is given to the SR, and released in 527 * smb_user_logoff_tq / smb_request_free 528 */ 529 sr->uid_user = user; 530 sr->user_cr = user->u_cred; 531 sr->sr_state = SMB_REQ_STATE_SUBMITTED; 532 533 (void) taskq_dispatch( 534 user->u_server->sv_worker_pool, 535 smb_user_logoff_tq, sr, TQ_SLEEP); 536 } 537 538 /* 539 * Helper for smb_user_auth_tmo() 540 */ 541 static void 542 smb_user_logoff_tq(void *arg) 543 { 544 smb_request_t *sr = arg; 545 546 SMB_REQ_VALID(sr); 547 548 mutex_enter(&sr->sr_mutex); 549 sr->sr_worker = curthread; 550 sr->sr_state = SMB_REQ_STATE_ACTIVE; 551 mutex_exit(&sr->sr_mutex); 552 553 smb_user_logoff(sr->uid_user); 554 555 sr->sr_state = SMB_REQ_STATE_COMPLETED; 556 smb_request_free(sr); 557 } 558 559 /* 560 * Determine whether or not the user is an administrator. 561 * Members of the administrators group have administrative rights. 562 */ 563 boolean_t 564 smb_user_is_admin(smb_user_t *user) 565 { 566 #ifdef _KERNEL 567 char sidstr[SMB_SID_STRSZ]; 568 ksidlist_t *ksidlist; 569 ksid_t ksid1; 570 ksid_t *ksid2; 571 int i; 572 #endif /* _KERNEL */ 573 boolean_t rc = B_FALSE; 574 575 ASSERT(user); 576 ASSERT(user->u_cred); 577 578 if (SMB_USER_IS_ADMIN(user)) 579 return (B_TRUE); 580 581 #ifdef _KERNEL 582 bzero(&ksid1, sizeof (ksid_t)); 583 (void) strlcpy(sidstr, ADMINISTRATORS_SID, SMB_SID_STRSZ); 584 ASSERT(smb_sid_splitstr(sidstr, &ksid1.ks_rid) == 0); 585 ksid1.ks_domain = ksid_lookupdomain(sidstr); 586 587 ksidlist = crgetsidlist(user->u_cred); 588 ASSERT(ksidlist); 589 ASSERT(ksid1.ks_domain); 590 ASSERT(ksid1.ks_domain->kd_name); 591 592 i = 0; 593 ksid2 = crgetsid(user->u_cred, KSID_USER); 594 do { 595 ASSERT(ksid2->ks_domain); 596 ASSERT(ksid2->ks_domain->kd_name); 597 598 if (strcmp(ksid1.ks_domain->kd_name, 599 ksid2->ks_domain->kd_name) == 0 && 600 ksid1.ks_rid == ksid2->ks_rid) { 601 user->u_flags |= SMB_USER_FLAG_ADMIN; 602 rc = B_TRUE; 603 break; 604 } 605 606 ksid2 = &ksidlist->ksl_sids[i]; 607 } while (i++ < ksidlist->ksl_nsid); 608 609 ksid_rele(&ksid1); 610 #endif /* _KERNEL */ 611 return (rc); 612 } 613 614 /* 615 * This function should be called with a hold on the user. 616 */ 617 boolean_t 618 smb_user_namecmp(smb_user_t *user, const char *name) 619 { 620 char *fq_name; 621 boolean_t match; 622 623 if (smb_strcasecmp(name, user->u_name, 0) == 0) 624 return (B_TRUE); 625 626 fq_name = kmem_alloc(MAXNAMELEN, KM_SLEEP); 627 628 (void) snprintf(fq_name, MAXNAMELEN, "%s\\%s", 629 user->u_domain, user->u_name); 630 631 match = (smb_strcasecmp(name, fq_name, 0) == 0); 632 if (!match) { 633 (void) snprintf(fq_name, MAXNAMELEN, "%s@%s", 634 user->u_name, user->u_domain); 635 636 match = (smb_strcasecmp(name, fq_name, 0) == 0); 637 } 638 639 kmem_free(fq_name, MAXNAMELEN); 640 return (match); 641 } 642 643 /* 644 * If the enumeration request is for user data, handle the request 645 * here. Otherwise, pass it on to the trees. 646 * 647 * This function should be called with a hold on the user. 648 */ 649 int 650 smb_user_enum(smb_user_t *user, smb_svcenum_t *svcenum) 651 { 652 int rc = 0; 653 654 ASSERT(user); 655 ASSERT(user->u_magic == SMB_USER_MAGIC); 656 657 if (svcenum->se_type == SMB_SVCENUM_TYPE_USER) 658 return (smb_user_enum_private(user, svcenum)); 659 660 return (rc); 661 } 662 663 /* *************************** Static Functions ***************************** */ 664 665 /* 666 * Delete a user. The tree list should be empty. 667 * 668 * Remove the user from the session's user list before freeing resources 669 * associated with the user. 670 */ 671 static void 672 smb_user_delete(void *arg) 673 { 674 smb_session_t *session; 675 smb_user_t *user = (smb_user_t *)arg; 676 uint32_t ucount; 677 678 SMB_USER_VALID(user); 679 ASSERT(user->u_refcnt == 0); 680 ASSERT(user->u_state == SMB_USER_STATE_LOGGED_OFF); 681 ASSERT(user->u_authsock == NULL); 682 ASSERT(user->u_auth_tmo == NULL); 683 684 session = user->u_session; 685 686 smb_server_dec_users(session->s_server); 687 smb_llist_enter(&session->s_user_list, RW_WRITER); 688 smb_llist_remove(&session->s_user_list, user); 689 smb_idpool_free(&session->s_uid_pool, user->u_uid); 690 ucount = smb_llist_get_count(&session->s_user_list); 691 smb_llist_exit(&session->s_user_list); 692 693 /* 694 * When the last smb_user_t object goes away, schedule a timeout 695 * after which we'll terminate this session if the client hasn't 696 * authenticated another smb_user_t on this session by then. 697 */ 698 if (ucount == 0) { 699 smb_rwx_rwenter(&session->s_lock, RW_WRITER); 700 if (session->s_state == SMB_SESSION_STATE_NEGOTIATED && 701 session->s_auth_tmo == NULL) { 702 session->s_auth_tmo = 703 timeout((tmo_func_t)smb_session_disconnect, 704 session, SEC_TO_TICK(smb_session_auth_tmo)); 705 } 706 smb_rwx_cvbcast(&session->s_lock); 707 smb_rwx_rwexit(&session->s_lock); 708 } 709 710 /* 711 * This user is no longer on s_user_list, however... 712 * 713 * This is called via smb_llist_post, which means it may run 714 * BEFORE smb_user_release drops u_mutex (if another thread 715 * flushes the delete queue before we do). Synchronize. 716 */ 717 mutex_enter(&user->u_mutex); 718 mutex_exit(&user->u_mutex); 719 720 user->u_magic = (uint32_t)~SMB_USER_MAGIC; 721 mutex_destroy(&user->u_mutex); 722 if (user->u_cred) 723 crfree(user->u_cred); 724 if (user->u_privcred) 725 crfree(user->u_privcred); 726 smb_mem_free(user->u_name); 727 smb_mem_free(user->u_domain); 728 kmem_cache_free(smb_cache_user, user); 729 } 730 731 cred_t * 732 smb_user_getcred(smb_user_t *user) 733 { 734 return (user->u_cred); 735 } 736 737 cred_t * 738 smb_user_getprivcred(smb_user_t *user) 739 { 740 return ((user->u_privcred)? user->u_privcred : user->u_cred); 741 } 742 743 #ifdef _KERNEL 744 /* 745 * Assign the user cred and privileges. 746 * 747 * If the user has backup and/or restore privleges, dup the cred 748 * and add those privileges to this new privileged cred. 749 */ 750 void 751 smb_user_setcred(smb_user_t *user, cred_t *cr, uint32_t privileges) 752 { 753 cred_t *privcred = NULL; 754 755 ASSERT(cr); 756 crhold(cr); 757 758 /* 759 * See smb.4 bypass_traverse_checking 760 * 761 * For historical reasons, the Windows privilege is named 762 * SeChangeNotifyPrivilege, though the description is 763 * "Bypass traverse checking". 764 */ 765 if ((privileges & SMB_USER_PRIV_CHANGE_NOTIFY) != 0) { 766 (void) crsetpriv(cr, PRIV_FILE_DAC_SEARCH, NULL); 767 } 768 769 /* 770 * Window's "take ownership privilege" is similar to our 771 * PRIV_FILE_CHOWN privilege. It's normally given to members of the 772 * "Administrators" group, which normally includes the the local 773 * Administrator (like root) and when joined to a domain, 774 * "Domain Admins". 775 */ 776 if ((privileges & SMB_USER_PRIV_TAKE_OWNERSHIP) != 0) { 777 (void) crsetpriv(cr, 778 PRIV_FILE_CHOWN, 779 PRIV_FILE_CHOWN_SELF, 780 NULL); 781 } 782 783 /* 784 * Bypass ACL for READ accesses. 785 */ 786 if ((privileges & SMB_USER_PRIV_READ_FILE) != 0) { 787 (void) crsetpriv(cr, PRIV_FILE_DAC_READ, NULL); 788 } 789 790 /* 791 * Bypass ACL for WRITE accesses. 792 * Include FILE_OWNER, as it covers WRITE_ACL and DELETE. 793 */ 794 if ((privileges & SMB_USER_PRIV_WRITE_FILE) != 0) { 795 (void) crsetpriv(cr, 796 PRIV_FILE_DAC_WRITE, 797 PRIV_FILE_OWNER, 798 NULL); 799 } 800 801 /* 802 * These privileges are used only when a file is opened with 803 * 'backup intent'. These allow users to bypass certain access 804 * controls. Administrators typically have these privileges, 805 * and they are used during recursive take-ownership operations. 806 * Some commonly used tools use 'backup intent' to administrate 807 * files that do not grant explicit permissions to Administrators. 808 */ 809 if (privileges & (SMB_USER_PRIV_BACKUP | SMB_USER_PRIV_RESTORE)) 810 privcred = crdup(cr); 811 812 if (privcred != NULL) { 813 if (privileges & SMB_USER_PRIV_BACKUP) { 814 (void) crsetpriv(privcred, PRIV_FILE_DAC_READ, 815 PRIV_FILE_DAC_SEARCH, PRIV_SYS_MOUNT, NULL); 816 } 817 818 if (privileges & SMB_USER_PRIV_RESTORE) { 819 (void) crsetpriv(privcred, PRIV_FILE_DAC_WRITE, 820 PRIV_FILE_CHOWN, PRIV_FILE_CHOWN_SELF, 821 PRIV_FILE_DAC_SEARCH, PRIV_FILE_LINK_ANY, 822 PRIV_FILE_OWNER, PRIV_FILE_SETID, 823 PRIV_SYS_LINKDIR, PRIV_SYS_MOUNT, NULL); 824 } 825 } 826 827 user->u_cred = cr; 828 user->u_privcred = privcred; 829 user->u_privileges = privileges; 830 } 831 #endif /* _KERNEL */ 832 833 /* 834 * Private function to support smb_user_enum. 835 */ 836 static int 837 smb_user_enum_private(smb_user_t *user, smb_svcenum_t *svcenum) 838 { 839 uint8_t *pb; 840 uint_t nbytes; 841 int rc; 842 843 if (svcenum->se_nskip > 0) { 844 svcenum->se_nskip--; 845 return (0); 846 } 847 848 if (svcenum->se_nitems >= svcenum->se_nlimit) { 849 svcenum->se_nitems = svcenum->se_nlimit; 850 return (0); 851 } 852 853 pb = &svcenum->se_buf[svcenum->se_bused]; 854 rc = smb_user_netinfo_encode(user, pb, svcenum->se_bavail, &nbytes); 855 if (rc == 0) { 856 svcenum->se_bavail -= nbytes; 857 svcenum->se_bused += nbytes; 858 svcenum->se_nitems++; 859 } 860 861 return (rc); 862 } 863 864 /* 865 * Encode the NetInfo for a user into a buffer. NetInfo contains 866 * information that is often needed in user space to support RPC 867 * requests. 868 */ 869 int 870 smb_user_netinfo_encode(smb_user_t *user, uint8_t *buf, size_t buflen, 871 uint32_t *nbytes) 872 { 873 smb_netuserinfo_t info; 874 int rc; 875 876 smb_user_netinfo_init(user, &info); 877 rc = smb_netuserinfo_encode(&info, buf, buflen, nbytes); 878 smb_user_netinfo_fini(&info); 879 880 return (rc); 881 } 882 883 void 884 smb_user_netinfo_init(smb_user_t *user, smb_netuserinfo_t *info) 885 { 886 smb_session_t *session; 887 char *buf; 888 889 ASSERT(user); 890 ASSERT(user->u_domain); 891 ASSERT(user->u_name); 892 893 session = user->u_session; 894 ASSERT(session); 895 ASSERT(session->workstation); 896 897 info->ui_session_id = session->s_kid; 898 info->ui_native_os = session->native_os; 899 info->ui_ipaddr = session->ipaddr; 900 info->ui_numopens = session->s_file_cnt; 901 info->ui_logon_time = user->u_logon_time; 902 info->ui_flags = user->u_flags; 903 info->ui_posix_uid = crgetuid(user->u_cred); 904 905 info->ui_domain_len = user->u_domain_len; 906 info->ui_domain = smb_mem_strdup(user->u_domain); 907 908 info->ui_account_len = user->u_name_len; 909 info->ui_account = smb_mem_strdup(user->u_name); 910 911 buf = kmem_alloc(MAXNAMELEN, KM_SLEEP); 912 smb_session_getclient(session, buf, MAXNAMELEN); 913 info->ui_workstation_len = strlen(buf) + 1; 914 info->ui_workstation = smb_mem_strdup(buf); 915 kmem_free(buf, MAXNAMELEN); 916 } 917 918 void 919 smb_user_netinfo_fini(smb_netuserinfo_t *info) 920 { 921 if (info == NULL) 922 return; 923 924 if (info->ui_domain) 925 smb_mem_free(info->ui_domain); 926 if (info->ui_account) 927 smb_mem_free(info->ui_account); 928 if (info->ui_workstation) 929 smb_mem_free(info->ui_workstation); 930 931 bzero(info, sizeof (smb_netuserinfo_t)); 932 } 933 934 /* 935 * Tell smbd this user is going away so it can clean up their 936 * audit session, autohome dir, etc. 937 * 938 * Note that when we're shutting down, smbd will already have set 939 * smbd.s_shutting_down and therefore will ignore door calls. 940 * Skip this during shutdown to reduce upcall noise. 941 */ 942 static void 943 smb_user_auth_logoff(smb_user_t *user) 944 { 945 smb_server_t *sv = user->u_server; 946 uint32_t audit_sid; 947 948 if (sv->sv_state != SMB_SERVER_STATE_RUNNING) 949 return; 950 951 audit_sid = user->u_audit_sid; 952 (void) smb_kdoor_upcall(sv, SMB_DR_USER_AUTH_LOGOFF, 953 &audit_sid, xdr_uint32_t, NULL, NULL); 954 } 955 956 boolean_t 957 smb_is_same_user(cred_t *cr1, cred_t *cr2) 958 { 959 ksid_t *ks1 = crgetsid(cr1, KSID_USER); 960 ksid_t *ks2 = crgetsid(cr2, KSID_USER); 961 962 return (ks1->ks_rid == ks2->ks_rid && 963 strcmp(ks1->ks_domain->kd_name, ks2->ks_domain->kd_name) == 0); 964 } 965