1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #pragma ident "%Z%%M% %I% %E% SMI" 27 28 #include <sys/types.h> 29 #include <errno.h> 30 #include <synch.h> 31 #include <stdio.h> 32 #include <stdlib.h> 33 #include <unistd.h> 34 #include <string.h> 35 #include <strings.h> 36 #include <syslog.h> 37 #include <fcntl.h> 38 #include <bsm/adt.h> 39 #include <bsm/adt_event.h> 40 #include <bsm/audit_uevents.h> 41 #include "smbd.h" 42 43 44 /* 45 * An audit session is established at user logon and terminated at user 46 * logoff. 47 * 48 * SMB audit handles are allocated when users logon (SmbSessionSetupX) 49 * and deallocted when a user logs off (SmbLogoffX). Each time an SMB 50 * audit handle is allocated it is added to a global list. 51 */ 52 typedef struct smb_audit { 53 struct smb_audit *sa_next; 54 adt_session_data_t *sa_handle; 55 uid_t sa_uid; 56 gid_t sa_gid; 57 uint32_t sa_audit_sid; 58 uint32_t sa_refcnt; 59 char *sa_domain; 60 char *sa_username; 61 } smb_audit_t; 62 63 static smb_audit_t *smbd_audit_list; 64 static mutex_t smbd_audit_lock; 65 66 /* 67 * Unique identifier for audit sessions in the audit list. 68 * Used to lookup an audit session on logoff. 69 */ 70 static uint32_t smbd_audit_sid; 71 72 static void smbd_audit_link(smb_audit_t *); 73 static smb_audit_t *smbd_audit_unlink(uint32_t); 74 75 76 /* 77 * Invoked at user logon due to SmbSessionSetupX. Authenticate the 78 * user, start an audit session and audit the event. 79 */ 80 smb_token_t * 81 smbd_user_auth_logon(netr_client_t *clnt) 82 { 83 smb_token_t *token; 84 smb_audit_t *entry; 85 adt_session_data_t *ah; 86 adt_event_data_t *event; 87 au_tid_addr_t termid; 88 char sidbuf[SMB_SID_STRSZ]; 89 uid_t uid; 90 gid_t gid; 91 char *sid; 92 int status; 93 int retval; 94 95 if ((token = smb_logon(clnt)) == NULL) { 96 uid = ADT_NO_ATTRIB; 97 gid = ADT_NO_ATTRIB; 98 sid = NT_NULL_SIDSTR; 99 status = ADT_FAILURE; 100 retval = ADT_FAIL_VALUE_AUTH; 101 } else { 102 uid = token->tkn_user->i_id; 103 gid = token->tkn_primary_grp->i_id; 104 smb_sid_tostr(token->tkn_user->i_sidattr.sid, sidbuf); 105 sid = sidbuf; 106 status = ADT_SUCCESS; 107 retval = ADT_SUCCESS; 108 } 109 110 if (adt_start_session(&ah, NULL, 0)) { 111 syslog(LOG_AUTH | LOG_ALERT, "adt_start_session: %m"); 112 smb_token_destroy(token); 113 return (NULL); 114 } 115 116 if ((event = adt_alloc_event(ah, ADT_smbd_session)) == NULL) { 117 syslog(LOG_AUTH | LOG_ALERT, 118 "adt_alloc_event(ADT_smbd_session): %m"); 119 (void) adt_end_session(ah); 120 smb_token_destroy(token); 121 return (NULL); 122 } 123 124 (void) memset(&termid, 0, sizeof (au_tid_addr_t)); 125 termid.at_port = clnt->local_port; 126 termid.at_type = AU_IPv4; 127 termid.at_addr[0] = clnt->ipaddr; 128 adt_set_termid(ah, &termid); 129 130 if (adt_set_user(ah, uid, gid, uid, gid, NULL, ADT_NEW)) { 131 syslog(LOG_AUTH | LOG_ALERT, "adt_set_user: %m"); 132 adt_free_event(event); 133 (void) adt_end_session(ah); 134 smb_token_destroy(token); 135 return (NULL); 136 } 137 138 event->adt_smbd_session.domain = clnt->domain; 139 event->adt_smbd_session.username = clnt->username; 140 event->adt_smbd_session.sid = sid; 141 142 if (adt_put_event(event, status, retval)) 143 syslog(LOG_AUTH | LOG_ALERT, "adt_put_event: %m"); 144 145 adt_free_event(event); 146 147 if (token) { 148 if ((entry = malloc(sizeof (smb_audit_t))) == NULL) { 149 syslog(LOG_ERR, "smbd_user_auth_logon: %m"); 150 (void) adt_end_session(ah); 151 smb_token_destroy(token); 152 return (NULL); 153 } 154 155 entry->sa_handle = ah; 156 entry->sa_uid = uid; 157 entry->sa_gid = gid; 158 entry->sa_username = strdup(clnt->username); 159 entry->sa_domain = strdup(clnt->domain); 160 161 (void) smb_autohome_add(entry->sa_username); 162 smbd_audit_link(entry); 163 token->tkn_audit_sid = entry->sa_audit_sid; 164 } 165 166 return (token); 167 } 168 169 /* 170 * Logon due to a subsequent SmbSessionSetupX on an existing session. 171 * The user was authenticated during the initial session setup. 172 */ 173 void 174 smbd_user_nonauth_logon(uint32_t audit_sid) 175 { 176 smb_audit_t *entry; 177 178 (void) mutex_lock(&smbd_audit_lock); 179 entry = smbd_audit_list; 180 181 while (entry) { 182 if (entry->sa_audit_sid == audit_sid) { 183 ++entry->sa_refcnt; 184 break; 185 } 186 187 entry = entry->sa_next; 188 } 189 190 (void) mutex_unlock(&smbd_audit_lock); 191 } 192 193 /* 194 * Invoked at user logoff due to SmbLogoffX. If this is the final 195 * logoff for this user on the session, audit the event and terminate 196 * the audit session. 197 */ 198 void 199 smbd_user_auth_logoff(uint32_t audit_sid) 200 { 201 smb_audit_t *entry; 202 adt_session_data_t *ah; 203 adt_event_data_t *event; 204 205 if ((entry = smbd_audit_unlink(audit_sid)) == NULL) 206 return; 207 208 (void) smb_autohome_remove(entry->sa_username); 209 210 ah = entry->sa_handle; 211 212 if ((event = adt_alloc_event(ah, ADT_smbd_logoff)) == NULL) { 213 syslog(LOG_AUTH | LOG_ALERT, 214 "adt_alloc_event(ADT_smbd_logoff): %m"); 215 } else { 216 event->adt_smbd_logoff.domain = entry->sa_domain; 217 event->adt_smbd_logoff.username = entry->sa_username; 218 219 if (adt_put_event(event, ADT_SUCCESS, ADT_SUCCESS)) 220 syslog(LOG_AUTH | LOG_ALERT, "adt_put_event: %m"); 221 222 adt_free_event(event); 223 } 224 225 (void) adt_end_session(ah); 226 227 free(entry->sa_username); 228 free(entry->sa_domain); 229 free(entry); 230 } 231 232 /* 233 * Allocate an id and link an audit handle onto the global list. 234 */ 235 static void 236 smbd_audit_link(smb_audit_t *entry) 237 { 238 (void) mutex_lock(&smbd_audit_lock); 239 240 do { 241 ++smbd_audit_sid; 242 } while ((smbd_audit_sid == 0) || (smbd_audit_sid == (uint32_t)-1)); 243 244 entry->sa_audit_sid = smbd_audit_sid; 245 entry->sa_refcnt = 1; 246 entry->sa_next = smbd_audit_list; 247 smbd_audit_list = entry; 248 249 (void) mutex_unlock(&smbd_audit_lock); 250 } 251 252 /* 253 * Unlink an audit handle. If the reference count reaches 0, the entry 254 * is removed from the list and returned. Otherwise the entry remains 255 * on the list and a null pointer is returned. 256 */ 257 static smb_audit_t * 258 smbd_audit_unlink(uint32_t audit_sid) 259 { 260 smb_audit_t *entry; 261 smb_audit_t **ppe; 262 263 (void) mutex_lock(&smbd_audit_lock); 264 ppe = &smbd_audit_list; 265 266 while (*ppe) { 267 entry = *ppe; 268 269 if (entry->sa_audit_sid == audit_sid) { 270 if (entry->sa_refcnt == 0) 271 break; 272 273 if ((--entry->sa_refcnt) != 0) 274 break; 275 276 *ppe = entry->sa_next; 277 (void) mutex_unlock(&smbd_audit_lock); 278 return (entry); 279 } 280 281 ppe = &(*ppe)->sa_next; 282 } 283 284 (void) mutex_unlock(&smbd_audit_lock); 285 return (NULL); 286 } 287