static int
smbd_authsock_create(void)
{
int sock = -1;
sock = socket(AF_UNIX, SOCK_STREAM, 0);
if (sock < 0) {
smbd_report("authsvc, socket create failed, %d", errno);
return (errno);
}
(void) unlink(smbauth_sockname.sun_path);
if (bind(sock, (struct sockaddr *)&smbauth_sockname,
sizeof (smbauth_sockname)) < 0) {
smbd_report("authsvc, socket bind failed, %d", errno);
(void) close(sock);
return (errno);
}
if (listen(sock, SOMAXCONN) < 0) {
smbd_report("authsvc, socket listen failed, %d", errno);
(void) close(sock);
return (errno);
}
smbd.s_authsvc_sock = sock;
return (0);
}
/*
* Shutdown smbd and smbsrv kernel services.
*
* Called only by the main thread.
*/
static void
smbd_service_fini(void)
{
smbd.s_shutting_down = B_TRUE;
smbd_report("service shutting down");
smb_kmod_stop();
smb_logon_abort();
smb_lgrp_stop();
smbd_pipesvc_stop();
smbd_door_stop();
smbd_spool_stop();
smbd_kernel_unbind();
smbd_share_stop();
smb_shr_stop();
dyndns_stop();
smbd_nicmon_stop();
smb_ccache_remove(SMB_CCACHE_PATH);
smb_pwd_fini();
smb_domain_fini();
mlsvc_fini();
smb_netbios_stop();
smbd_cups_fini();
smbd.s_initialized = B_FALSE;
smbd_report("service terminated");
closelog();
}
/*
* smbd_kernel_bind
*
* If smbsrv is already bound, reload the configuration and update smbsrv.
* Otherwise, open the smbsrv device and start the kernel service.
*/
static int
smbd_kernel_bind(void)
{
smb_kmod_cfg_t cfg;
int rc;
if (smbd.s_kbound) {
smb_load_kconfig(&cfg);
rc = smb_kmod_setcfg(&cfg);
if (rc < 0)
smbd_report("kernel configuration update failed: %s",
strerror(errno));
return (rc);
}
if (smb_kmod_isbound())
smbd_kernel_unbind();
if ((rc = smb_kmod_bind()) == 0) {
rc = smbd_kernel_start();
if (rc != 0)
smb_kmod_unbind();
else
smbd.s_kbound = B_TRUE;
}
if (rc != 0)
smbd_report("kernel bind error: %s", strerror(errno));
return (rc);
}
static int
smbd_kernel_start(void)
{
smb_kmod_cfg_t cfg;
int rc;
smb_load_kconfig(&cfg);
rc = smb_kmod_setcfg(&cfg);
if (rc != 0) {
smbd_report("kernel config ioctl error: %s", strerror(rc));
return (rc);
}
rc = smb_kmod_setgmtoff(smbd_gmtoff());
if (rc != 0) {
smbd_report("kernel gmtoff ioctl error: %s", strerror(rc));
return (rc);
}
rc = smb_kmod_start(smbd.s_door_opipe, smbd.s_door_lmshr,
smbd.s_door_srv);
if (rc != 0) {
smbd_report("kernel start ioctl error: %s", strerror(rc));
return (rc);
}
return (0);
}
/*
* We want to adjust a few things in the standard configuration
* passed to the "fake" version of the smbsrv kernel module.
*
* Reduce the maximum number of connections and workers, just for
* convenience while debugging. (Don't want hundreds of threads.)
*/
static void
fksmbd_adjust_config(smb_ioc_header_t *ioc_hdr)
{
smb_ioc_cfg_t *ioc = (smb_ioc_cfg_t *)ioc_hdr;
char *s;
ioc->maxconnections = 10;
ioc->maxworkers = 20;
smbd_report("maxconnections=%d, maxworkers=%d",
ioc->maxconnections, ioc->maxworkers);
if ((s = getenv("SMB_MAX_PROTOCOL")) != NULL) {
switch (s[0]) {
case '1':
ioc->max_protocol = SMB_VERS_1;
break;
case '2':
ioc->max_protocol = SMB_VERS_2_1;
break;
case '3':
ioc->max_protocol = SMB_VERS_3_0;
break;
default:
smbd_report("env SMB_MAX_PROTOCOL invalid");
break;
}
}
smbd_report("max_protocol=0x%x", ioc->max_protocol);
if ((s = getenv("SMB_SIGNING")) != NULL) {
ioc->signing_enable = 0;
ioc->signing_required = 0;
switch (s[0]) {
case 'e':
ioc->signing_enable = 1;
break;
case 'r':
ioc->signing_enable = 1;
ioc->signing_required = 1;
break;
default:
smbd_report("env SMB_SIGNING invalid");
break;
}
}
smbd_report("signing: enable=%d, required=%d",
ioc->signing_enable, ioc->signing_required);
}
/*
* If the door has already been opened by another process (non-zero pid
* in target), we assume that another smbd is already running. If there
* is a race here, it will be caught later when smbsrv is opened because
* only one process is allowed to open the device at a time.
*/
static int
smbd_already_running(void)
{
door_info_t info;
char *door_name;
int door;
door_name = getenv("SMBD_DOOR_NAME");
if (door_name == NULL)
door_name = SMBD_DOOR_NAME;
if ((door = open(door_name, O_RDONLY)) < 0)
return (0);
if (door_info(door, &info) < 0)
return (0);
if (info.di_target > 0) {
smbd_report("already running: pid %ld\n", info.di_target);
(void) close(door);
return (1);
}
(void) close(door);
return (0);
}
/*ARGSUSED*/
static void *
smbd_localtime_monitor(void *arg)
{
struct tm local_tm;
time_t secs;
int32_t gmtoff, last_gmtoff = -1;
int timeout;
int error;
smbd_online_wait("smbd_localtime_monitor");
for (;;) {
gmtoff = smbd_gmtoff();
if ((last_gmtoff != gmtoff) && smbd.s_kbound) {
error = smb_kmod_setgmtoff(gmtoff);
if (error != 0)
smbd_report("localtime set failed: %s",
strerror(error));
}
/*
* Align the next iteration on a fifteen minute boundary.
*/
secs = time(0);
(void) localtime_r(&secs, &local_tm);
timeout = ((15 - (local_tm.tm_min % 15)) * SECSPERMIN);
(void) sleep(timeout);
last_gmtoff = gmtoff;
}
/*NOTREACHED*/
return (NULL);
}
/*
* Shutdown smbd and smbsrv kernel services.
*
* Shutdown will not begin until initialization has completed.
* Only one thread is allowed to perform the shutdown. Other
* threads will be blocked on fini_in_progress until the process
* has exited.
*/
static void
smbd_service_fini(void)
{
static uint_t fini_in_progress;
(void) mutex_lock(&smbd_service_mutex);
while (!smbd.s_initialized)
(void) cond_wait(&smbd_service_cv, &smbd_service_mutex);
if (atomic_swap_uint(&fini_in_progress, 1) != 0) {
while (fini_in_progress)
(void) cond_wait(&smbd_service_cv, &smbd_service_mutex);
/*NOTREACHED*/
}
smbd.s_shutting_down = B_TRUE;
smbd_report("service shutting down");
smb_kmod_stop();
smb_logon_abort();
smb_lgrp_stop();
smbd_opipe_stop();
smbd_door_stop();
smbd_refresh_fini();
smbd_kernel_unbind();
smbd_share_stop();
smb_shr_stop();
dyndns_stop();
smbd_nicmon_stop();
smb_ccache_remove(SMB_CCACHE_PATH);
smb_pwd_fini();
smb_domain_fini();
mlsvc_fini();
smb_netbios_stop();
smbd_cups_fini();
smbd.s_initialized = B_FALSE;
smbd_report("service terminated");
(void) mutex_unlock(&smbd_service_mutex);
exit((smbd.s_fatal_error) ? SMF_EXIT_ERR_FATAL : SMF_EXIT_OK);
}
/*
* Called when SMF sends us a SIGHUP. Update the smbd configuration
* from SMF and check for changes that require service reconfiguration.
*/
static void
smbd_refresh_handler()
{
int new_debug;
if (smbd.s_shutting_down)
return;
smbd.s_refreshes++;
new_debug = smb_config_get_debug();
if (smbd.s_debug || new_debug)
smbd_report("debug=%d", new_debug);
smbd.s_debug = new_debug;
smbd_spool_stop();
smbd_dc_monitor_refresh();
smb_ccache_remove(SMB_CCACHE_PATH);
/*
* Clear the DNS zones for the existing interfaces
* before updating the NIC interface list.
*/
dyndns_clear_zones();
if (smbd_nicmon_refresh() != 0)
smbd_report("NIC monitor refresh failed");
smb_netbios_name_reconfig();
smb_browser_reconfig();
dyndns_update_zones();
/* This reloads the in-kernel config. */
(void) smbd_kernel_bind();
smbd_load_shares();
smbd_load_printers();
smbd_spool_start();
}
static void
smbd_authsvc_flood(void)
{
static uint_t count;
static time_t last_report;
time_t now = time(NULL);
count++;
if (last_report + 60 < now) {
last_report = now;
smbd_report("authsvc: flooded %u", count);
count = 0;
}
}
/*
* Launches a thread to populate the share cache by share information
* stored in sharemgr
*/
static void
smbd_load_shares(void)
{
pthread_t tid;
pthread_attr_t attr;
int rc;
(void) pthread_attr_init(&attr);
(void) pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
rc = pthread_create(&tid, &attr, smb_shr_load, NULL);
(void) pthread_attr_destroy(&attr);
if (rc != 0)
smbd_report("unable to load disk shares: %s", strerror(errno));
}
static void
smbd_localtime_init(void)
{
pthread_attr_t attr;
int rc;
(void) pthread_attr_init(&attr);
(void) pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
rc = pthread_create(&smbd.s_localtime_tid, &attr,
smbd_localtime_monitor, NULL);
(void) pthread_attr_destroy(&attr);
if (rc != 0)
smbd_report("unable to monitor localtime: %s", strerror(errno));
}
/*ARGSUSED*/
static void *
smbd_refresh_monitor(void *arg)
{
smbd_online_wait("smbd_refresh_monitor");
while (!smbd.s_shutting_down) {
(void) sleep(SMBD_REFRESH_INTERVAL);
(void) pthread_mutex_lock(&refresh_mutex);
while ((atomic_swap_uint(&smbd.s_refreshes, 0) == 0) &&
(!smbd.s_shutting_down))
(void) pthread_cond_wait(&refresh_cond, &refresh_mutex);
(void) pthread_mutex_unlock(&refresh_mutex);
if (smbd.s_shutting_down) {
smbd_service_fini();
/*NOTREACHED*/
}
(void) mutex_lock(&smbd_service_mutex);
smbd_dc_monitor_refresh();
smb_ccache_remove(SMB_CCACHE_PATH);
/*
* Clear the DNS zones for the existing interfaces
* before updating the NIC interface list.
*/
dyndns_clear_zones();
if (smbd_nicmon_refresh() != 0)
smbd_report("NIC monitor refresh failed");
smb_netbios_name_reconfig();
smb_browser_reconfig();
dyndns_update_zones();
(void) smbd_kernel_bind();
smbd_load_shares();
smbd_load_printers();
(void) mutex_unlock(&smbd_service_mutex);
}
smbd.s_refresh_tid = 0;
return (NULL);
}
/*
* Create the Dynamic DNS publisher thread.
*/
static void
smbd_dyndns_init(void)
{
pthread_t tid;
pthread_attr_t attr;
int rc;
dyndns_start();
(void) pthread_attr_init(&attr);
(void) pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
rc = pthread_create(&tid, &attr, dyndns_publisher, NULL);
(void) pthread_attr_destroy(&attr);
if (rc != 0)
smbd_report("unable to start dyndns publisher: %s",
strerror(errno));
}
/*
* If the door has already been opened by another process (non-zero pid
* in target), we assume that another smbd is already running. If there
* is a race here, it will be caught later when smbsrv is opened because
* only one process is allowed to open the device at a time.
*/
static int
smbd_already_running(void)
{
door_info_t info;
int door;
if ((door = open(SMBD_DOOR_NAME, O_RDONLY)) < 0)
return (0);
if (door_info(door, &info) < 0)
return (0);
if (info.di_target > 0) {
smbd_report("already running: pid %ld\n", info.di_target);
(void) close(door);
return (1);
}
(void) close(door);
return (0);
}
/*
* smbd_refresh_init()
*
* SMB service refresh thread initialization. This thread waits for a
* refresh event and updates the daemon's view of the configuration
* before going back to sleep.
*/
static int
smbd_refresh_init()
{
pthread_attr_t tattr;
pthread_condattr_t cattr;
int rc;
(void) pthread_condattr_init(&cattr);
(void) pthread_cond_init(&refresh_cond, &cattr);
(void) pthread_condattr_destroy(&cattr);
(void) pthread_mutex_init(&refresh_mutex, NULL);
(void) pthread_attr_init(&tattr);
(void) pthread_attr_setdetachstate(&tattr, PTHREAD_CREATE_DETACHED);
rc = pthread_create(&smbd.s_refresh_tid, &tattr, smbd_refresh_monitor,
NULL);
(void) pthread_attr_destroy(&tattr);
if (rc != 0)
smbd_report("unable to start refresh monitor: %s",
strerror(errno));
return (rc);
}
/*
* smbd_service_init
*/
static int
smbd_service_init(void)
{
static struct dir {
char *name;
int perm;
} dir[] = {
{ SMB_DBDIR, 0700 },
{ SMB_CVOL, 0755 },
{ SMB_SYSROOT, 0755 },
{ SMB_SYSTEM32, 0755 },
{ SMB_VSS, 0755 },
{ SMB_PIPE_DIR, 0755 },
};
int rc, i;
smbd.s_pid = getpid();
/*
* Stop for a debugger attach here, which is after the
* fork() etc. in smb_daemonize_init()
*/
if (smbd.s_dbg_stop) {
smbd_report("pid %d stop for debugger attach", smbd.s_pid);
(void) kill(smbd.s_pid, SIGSTOP);
}
smbd_report("smbd starting, pid %d", smbd.s_pid);
for (i = 0; i < sizeof (dir)/sizeof (dir[0]); ++i) {
if ((mkdir(dir[i].name, dir[i].perm) < 0) &&
(errno != EEXIST)) {
smbd_report("mkdir %s: %s", dir[i].name,
strerror(errno));
return (-1);
}
}
if ((rc = smb_ccache_init(SMB_VARRUN_DIR, SMB_CCACHE_FILE)) != 0) {
if (rc == -1)
smbd_report("mkdir %s: %s", SMB_VARRUN_DIR,
strerror(errno));
else
smbd_report("unable to set KRB5CCNAME");
return (-1);
}
smb_codepage_init();
rc = smbd_cups_init();
if (smb_config_getbool(SMB_CI_PRINT_ENABLE))
smbd_report("print service %savailable", (rc == 0) ? "" : "un");
if (smbd_nicmon_start(SMBD_DEFAULT_INSTANCE_FMRI) != 0)
smbd_report("NIC monitor failed to start");
smbd_dyndns_init();
smb_ipc_init();
if (smb_config_getbool(SMB_CI_NETBIOS_ENABLE) == 0)
smbd_report("NetBIOS services disabled");
else if (smb_netbios_start() != 0)
smbd_report("NetBIOS services failed to start");
else
smbd_report("NetBIOS services started");
smbd.s_secmode = smb_config_get_secmode();
if ((rc = smb_domain_init(smbd.s_secmode)) != 0) {
if (rc == SMB_DOMAIN_NOMACHINE_SID) {
smbd_report(
"no machine SID: check idmap configuration");
return (-1);
}
}
if (smbd_dc_monitor_init() != 0)
smbd_report("DC monitor initialization failed %s",
strerror(errno));
if (smbd_pipesvc_start() != 0) {
smbd_report("pipesvc initialization failed");
return (-1);
}
smbd.s_door_srv = smbd_door_start();
if (smbd.s_door_srv < 0) {
smbd_report("door initialization failed %s", strerror(errno));
return (-1);
}
dyndns_update_zones();
smbd_localtime_init();
(void) smb_lgrp_start();
smb_pwd_init(B_TRUE);
if (smb_shr_start() != 0) {
smbd_report("share initialization failed: %s", strerror(errno));
return (-1);
}
smbd.s_door_lmshr = smbd_share_start();
if (smbd.s_door_lmshr < 0)
smbd_report("share initialization failed");
/* Open the driver, load the kernel config. */
if (smbd_kernel_bind() != 0) {
return (-1);
}
smbd_load_shares();
smbd_load_printers();
smbd_spool_start();
smbd.s_initialized = B_TRUE;
smbd_report("service initialized");
return (0);
}
/*
* smbd_service_init
*/
static int
smbd_service_init(void)
{
static struct dir {
char *name;
int perm;
} dir[] = {
{ SMB_DBDIR, 0700 },
{ SMB_CVOL, 0755 },
{ SMB_SYSROOT, 0755 },
{ SMB_SYSTEM32, 0755 },
{ SMB_VSS, 0755 }
};
int rc, i;
(void) mutex_lock(&smbd_service_mutex);
smbd.s_pid = getpid();
for (i = 0; i < sizeof (dir)/sizeof (dir[0]); ++i) {
if ((mkdir(dir[i].name, dir[i].perm) < 0) &&
(errno != EEXIST)) {
smbd_report("mkdir %s: %s", dir[i].name,
strerror(errno));
(void) mutex_unlock(&smbd_service_mutex);
return (-1);
}
}
if ((rc = smb_ccache_init(SMB_VARRUN_DIR, SMB_CCACHE_FILE)) != 0) {
if (rc == -1)
smbd_report("mkdir %s: %s", SMB_VARRUN_DIR,
strerror(errno));
else
smbd_report("unable to set KRB5CCNAME");
(void) mutex_unlock(&smbd_service_mutex);
return (-1);
}
smbd.s_loghd = smb_log_create(SMBD_LOGSIZE, SMBD_LOGNAME);
smb_codepage_init();
rc = smbd_cups_init();
if (smb_config_getbool(SMB_CI_PRINT_ENABLE))
smbd_report("print service %savailable", (rc == 0) ? "" : "un");
if (smbd_nicmon_start(SMBD_DEFAULT_INSTANCE_FMRI) != 0)
smbd_report("NIC monitor failed to start");
smbd_dyndns_init();
smb_ipc_init();
if (smb_netbios_start() != 0)
smbd_report("NetBIOS services failed to start");
else
smbd_report("NetBIOS services started");
smbd.s_secmode = smb_config_get_secmode();
if ((rc = smb_domain_init(smbd.s_secmode)) != 0) {
if (rc == SMB_DOMAIN_NOMACHINE_SID) {
smbd_report(
"no machine SID: check idmap configuration");
(void) mutex_unlock(&smbd_service_mutex);
return (-1);
}
}
if (smbd_dc_monitor_init() != 0)
smbd_report("DC monitor initialization failed %s",
strerror(errno));
if (mlsvc_init() != 0) {
smbd_report("msrpc initialization failed");
(void) mutex_unlock(&smbd_service_mutex);
return (-1);
}
smbd.s_door_srv = smbd_door_start();
smbd.s_door_opipe = smbd_opipe_start();
if (smbd.s_door_srv < 0 || smbd.s_door_opipe < 0) {
smbd_report("door initialization failed %s", strerror(errno));
(void) mutex_unlock(&smbd_service_mutex);
return (-1);
}
if (smbd_refresh_init() != 0) {
(void) mutex_unlock(&smbd_service_mutex);
return (-1);
}
dyndns_update_zones();
smbd_localtime_init();
(void) smb_lgrp_start();
smb_pwd_init(B_TRUE);
if (smb_shr_start() != 0) {
smbd_report("share initialization failed: %s", strerror(errno));
(void) mutex_unlock(&smbd_service_mutex);
return (-1);
}
smbd.s_door_lmshr = smbd_share_start();
if (smbd.s_door_lmshr < 0)
smbd_report("share initialization failed");
if (smbd_kernel_bind() != 0) {
(void) mutex_unlock(&smbd_service_mutex);
return (-1);
}
smbd_load_shares();
smbd_load_printers();
smbd.s_initialized = B_TRUE;
smbd_report("service initialized");
(void) cond_signal(&smbd_service_cv);
(void) mutex_unlock(&smbd_service_mutex);
return (0);
}
/*
* This function will fork off a child process,
* from which only the child will return.
*
* Use SMF error codes only on exit.
*/
static int
smbd_daemonize_init(void)
{
int status, pfds[2];
sigset_t set, oset;
pid_t pid;
int rc;
/*
* Reset privileges to the minimum set required. We continue
* to run as root to create and access files in /var.
*/
rc = smb_init_daemon_priv(PU_RESETGROUPS, smbd.s_uid, smbd.s_gid);
if (rc != 0) {
smbd_report("insufficient privileges");
exit(SMF_EXIT_ERR_FATAL);
}
/*
* Block all signals prior to the fork and leave them blocked in the
* parent so we don't get in a situation where the parent gets SIGINT
* and returns non-zero exit status and the child is actually running.
* In the child, restore the signal mask once we've done our setsid().
*/
(void) sigfillset(&set);
(void) sigdelset(&set, SIGABRT);
(void) sigprocmask(SIG_BLOCK, &set, &oset);
if (pipe(pfds) == -1) {
smbd_report("unable to create pipe");
exit(SMF_EXIT_ERR_FATAL);
}
closelog();
if ((pid = fork()) == -1) {
openlog(smbd.s_pname, LOG_PID | LOG_NOWAIT, LOG_DAEMON);
smbd_report("unable to fork");
closelog();
exit(SMF_EXIT_ERR_FATAL);
}
/*
* If we're the parent process, wait for either the child to send us
* the appropriate exit status over the pipe or for the read to fail
* (presumably with 0 for EOF if our child terminated abnormally).
* If the read fails, exit with either the child's exit status if it
* exited or with SMF_EXIT_ERR_FATAL if it died from a fatal signal.
*/
if (pid != 0) {
(void) close(pfds[1]);
if (read(pfds[0], &status, sizeof (status)) == sizeof (status))
_exit(status);
if (waitpid(pid, &status, 0) == pid && WIFEXITED(status))
_exit(WEXITSTATUS(status));
_exit(SMF_EXIT_ERR_FATAL);
}
openlog(smbd.s_pname, LOG_PID | LOG_NOWAIT, LOG_DAEMON);
(void) setsid();
(void) sigprocmask(SIG_SETMASK, &oset, NULL);
(void) chdir("/");
(void) umask(022);
(void) close(pfds[0]);
return (pfds[1]);
}
/*
* Use SMF error codes only on return or exit.
*/
int
main(int argc, char *argv[])
{
struct sigaction act;
sigset_t set;
uid_t uid;
int pfd = -1;
uint_t sigval;
struct rlimit rl;
int orig_limit;
smbd.s_pname = basename(argv[0]);
openlog(smbd.s_pname, LOG_PID | LOG_NOWAIT, LOG_DAEMON);
if (smbd_setup_options(argc, argv) != 0)
return (SMF_EXIT_ERR_FATAL);
if ((uid = getuid()) != smbd.s_uid) {
smbd_report("user %d: %s", uid, strerror(EPERM));
return (SMF_EXIT_ERR_FATAL);
}
if (getzoneid() != GLOBAL_ZONEID) {
smbd_report("non-global zones are not supported");
return (SMF_EXIT_ERR_FATAL);
}
if (is_system_labeled()) {
smbd_report("Trusted Extensions not supported");
return (SMF_EXIT_ERR_FATAL);
}
if (smbd_already_running())
return (SMF_EXIT_OK);
/*
* Raise the file descriptor limit to accommodate simultaneous user
* authentications/file access.
*/
if ((getrlimit(RLIMIT_NOFILE, &rl) == 0) &&
(rl.rlim_cur < rl.rlim_max)) {
orig_limit = rl.rlim_cur;
rl.rlim_cur = rl.rlim_max;
if (setrlimit(RLIMIT_NOFILE, &rl) != 0)
smbd_report("Failed to raise file descriptor limit"
" from %d to %d", orig_limit, rl.rlim_cur);
}
(void) sigfillset(&set);
(void) sigdelset(&set, SIGABRT);
(void) sigfillset(&act.sa_mask);
act.sa_handler = smbd_sig_handler;
act.sa_flags = 0;
(void) sigaction(SIGABRT, &act, NULL);
(void) sigaction(SIGTERM, &act, NULL);
(void) sigaction(SIGHUP, &act, NULL);
(void) sigaction(SIGINT, &act, NULL);
(void) sigaction(SIGPIPE, &act, NULL);
(void) sigaction(SIGUSR1, &act, NULL);
(void) sigdelset(&set, SIGTERM);
(void) sigdelset(&set, SIGHUP);
(void) sigdelset(&set, SIGINT);
(void) sigdelset(&set, SIGPIPE);
(void) sigdelset(&set, SIGUSR1);
if (smbd.s_fg) {
(void) sigdelset(&set, SIGTSTP);
(void) sigdelset(&set, SIGTTIN);
(void) sigdelset(&set, SIGTTOU);
if (smbd_service_init() != 0) {
smbd_report("service initialization failed");
exit(SMF_EXIT_ERR_FATAL);
}
} else {
/*
* "pfd" is a pipe descriptor -- any fatal errors
* during subsequent initialization of the child
* process should be written to this pipe and the
* parent will report this error as the exit status.
*/
pfd = smbd_daemonize_init();
if (smbd_service_init() != 0) {
smbd_report("daemon initialization failed");
exit(SMF_EXIT_ERR_FATAL);
}
smbd_daemonize_fini(pfd, SMF_EXIT_OK);
}
(void) atexit(smb_kmod_stop);
while (!smbd.s_shutting_down) {
if (smbd.s_sigval == 0 && smbd.s_refreshes == 0)
(void) sigsuspend(&set);
sigval = atomic_swap_uint(&smbd.s_sigval, 0);
switch (sigval) {
case 0:
case SIGPIPE:
case SIGABRT:
break;
case SIGHUP:
syslog(LOG_DEBUG, "refresh requested");
(void) pthread_cond_signal(&refresh_cond);
break;
case SIGUSR1:
smb_log_dumpall();
break;
default:
/*
* Typically SIGINT or SIGTERM.
*/
smbd.s_shutting_down = B_TRUE;
break;
}
}
smbd_service_fini();
closelog();
return ((smbd.s_fatal_error) ? SMF_EXIT_ERR_FATAL : SMF_EXIT_OK);
}
krb5_error_code
_krb5_override_service_locator(
void *arg0,
enum locate_service_type svc,
const char *realm,
int socktype,
int family,
int (*cbfunc)(void *, int, struct sockaddr *),
void *cbdata)
{
_NOTE(ARGUNUSED(arg0))
smb_domainex_t dxi;
int rc = KRB5_PLUGIN_NO_HANDLE;
short port;
/*
* Is this a service we want to override?
*/
switch (svc) {
case locate_service_kdc:
case locate_service_master_kdc:
port = htons(KRB5_DEFAULT_PORT);
break;
case locate_service_kadmin:
port = htons(DEFAULT_KADM5_PORT);
break;
case locate_service_kpasswd:
port = htons(DEFAULT_KPASSWD_PORT);
break;
case locate_service_krb524:
default:
return (rc);
}
/*
* What's my domain? Note: have to get this in a way
* that works while join domain is underway.
*/
if (!smb_domain_getinfo(&dxi)) {
smbd_report("_krb5_override_service_locator "
"failed getting domain info");
return (KRB5_ERR_HOST_REALM_UNKNOWN);
}
/*
* Is this a realm we want to override?
*/
if (0 != strcasecmp(realm, dxi.d_primary.di_fqname)) {
syslog(LOG_DEBUG, "_krb5_override_service_locator, "
"realm=%s, fqdn=%s", realm, dxi.d_primary.di_fqname);
return (rc);
}
/*
* Yes, this is our domain. Have a DC?
*/
if (dxi.d_dci.dc_name[0] == '\0' ||
dxi.d_dci.dc_addr.a_family == 0)
return (KRB5_REALM_CANT_RESOLVE);
switch (family) {
case AF_UNSPEC:
break; /* OK */
case AF_INET:
case AF_INET6:
if (family == dxi.d_dci.dc_addr.a_family)
break; /* OK */
/* else fallthrough */
default:
return (KRB5_ERR_NO_SERVICE);
}
/*
* Provide the service address we have.
*/
switch (dxi.d_dci.dc_addr.a_family) {
case AF_INET: {
struct sockaddr_in sin;
(void) memset(&sin, 0, sizeof (sin));
sin.sin_family = AF_INET;
sin.sin_port = port;
(void) memcpy(&sin.sin_addr, &dxi.d_dci.dc_addr.a_ipv4,
sizeof (sin.sin_addr));
rc = cbfunc(cbdata, socktype, (struct sockaddr *)&sin);
/* rc from cbfunc is special. */
if (rc)
rc = ENOMEM;
break;
}
case AF_INET6: {
struct sockaddr_in6 sin6;
(void) memset(&sin6, 0, sizeof (sin6));
sin6.sin6_family = AF_INET6;
sin6.sin6_port = port;
(void) memcpy(&sin6.sin6_addr, &dxi.d_dci.dc_addr.a_ipv6,
sizeof (sin6.sin6_addr));
rc = cbfunc(cbdata, socktype, (struct sockaddr *)&sin6);
/* rc from cbfunc is special. */
if (rc)
rc = ENOMEM;
break;
}
default:
rc = KRB5_ERR_NO_SERVICE;
break;
}
return (rc);
}
static void *
smbd_authsvc_work(void *arg)
{
authsvc_context_t *ctx = arg;
smb_lsa_msg_hdr_t hdr;
int sock = ctx->ctx_socket;
int len, rc;
if (setsockopt(sock, SOL_SOCKET, SO_SNDTIMEO,
(char *)&send_tmo, sizeof (send_tmo)) != 0) {
smbd_report("authsvc_work: set set timeout: %m");
goto out;
}
if (setsockopt(sock, SOL_SOCKET, SO_RCVTIMEO,
(char *)&recv_tmo, sizeof (recv_tmo)) != 0) {
smbd_report("authsvc_work: set recv timeout: %m");
goto out;
}
for (;;) {
len = recv(sock, &hdr, sizeof (hdr), MSG_WAITALL);
if (len <= 0) {
/* normal termination */
break;
}
if (len != sizeof (hdr)) {
smbd_report("authsvc_work: read header failed");
break;
}
if (hdr.lmh_msglen > smbd_authsvc_bufsize) {
smbd_report("authsvc_work: msg too large");
break;
}
if (hdr.lmh_msglen > 0) {
len = recv(sock, ctx->ctx_irawbuf, hdr.lmh_msglen,
MSG_WAITALL);
if (len != hdr.lmh_msglen) {
smbd_report("authsvc_work: read mesg failed");
break;
}
}
ctx->ctx_irawtype = hdr.lmh_msgtype;
ctx->ctx_irawlen = hdr.lmh_msglen;
ctx->ctx_orawlen = smbd_authsvc_bufsize;
ctx->ctx_ibodylen = smbd_authsvc_bufsize;
ctx->ctx_obodylen = smbd_authsvc_bufsize;
/*
* The real work happens here.
*/
rc = smbd_authsvc_dispatch(ctx);
if (rc)
break;
hdr.lmh_msgtype = ctx->ctx_orawtype;
hdr.lmh_msglen = ctx->ctx_orawlen;
len = send(sock, &hdr, sizeof (hdr), 0);
if (len != sizeof (hdr)) {
smbd_report("authsvc_work: send failed");
break;
}
if (ctx->ctx_orawlen > 0) {
len = send(sock, ctx->ctx_orawbuf,
ctx->ctx_orawlen, 0);
if (len != ctx->ctx_orawlen) {
smbd_report("authsvc_work: send failed");
break;
}
}
}
out:
if (ctx->ctx_mh_fini)
(ctx->ctx_mh_fini)(ctx);
smbd_authctx_destroy(ctx);
(void) mutex_lock(&smbd_authsvc_mutex);
smbd_authsvc_thrcnt--;
(void) mutex_unlock(&smbd_authsvc_mutex);
return (NULL); /* implied pthread_exit() */
}
static void *
smbd_authsvc_listen(void *arg)
{
authsvc_context_t *ctx;
pthread_attr_t attr;
pthread_t tid;
socklen_t slen;
int ls, ns, rc;
_NOTE(ARGUNUSED(arg))
(void) pthread_attr_init(&attr);
(void) pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
ls = smbd.s_authsvc_sock;
for (;;) {
slen = 0;
ns = accept(ls, NULL, &slen);
if (ns < 0) {
switch (errno) {
case ECONNABORTED:
continue;
case EINTR:
/* normal termination */
goto out;
default:
smbd_report("authsvc, socket accept failed,"
" %d", errno);
goto out;
}
}
/*
* Limit the number of auth. sockets
* (and the threads that service them).
*/
(void) mutex_lock(&smbd_authsvc_mutex);
if (smbd_authsvc_thrcnt >= smbd_authsvc_maxthread) {
(void) mutex_unlock(&smbd_authsvc_mutex);
(void) close(ns);
smbd_authsvc_flood();
continue;
}
smbd_authsvc_thrcnt++;
if (smbd_authsvc_hiwat < smbd_authsvc_thrcnt)
smbd_authsvc_hiwat = smbd_authsvc_thrcnt;
(void) mutex_unlock(&smbd_authsvc_mutex);
ctx = smbd_authctx_create();
if (ctx == NULL) {
smbd_report("authsvc, can't allocate context");
(void) mutex_lock(&smbd_authsvc_mutex);
smbd_authsvc_thrcnt--;
(void) mutex_unlock(&smbd_authsvc_mutex);
(void) close(ns);
goto out;
}
ctx->ctx_socket = ns;
rc = pthread_create(&tid, &attr, smbd_authsvc_work, ctx);
if (rc) {
smbd_report("authsvc, thread create failed, %d", rc);
(void) mutex_lock(&smbd_authsvc_mutex);
smbd_authsvc_thrcnt--;
(void) mutex_unlock(&smbd_authsvc_mutex);
smbd_authctx_destroy(ctx);
goto out;
}
ctx = NULL; /* given to the new thread */
}
out:
(void) pthread_attr_destroy(&attr);
smbd_authsock_destroy();
return (NULL);
}
/*
* Handle a security blob we've received from the client.
* Incoming type: LSA_MTYPE_ESFIRST
* Outgoing types: LSA_MTYPE_ES_CONT, LSA_MTYPE_ES_DONE,
* LSA_MTYPE_ERROR
*/
static int
smbd_authsvc_esfirst(authsvc_context_t *ctx)
{
const spnego_mech_handler_t *mh;
int idx, pref, rc;
int best_pref = 1000;
int best_mhidx = -1;
/*
* NTLMSSP header is 8+, SPNEGO is 10+
*/
if (ctx->ctx_irawlen < 8) {
smbd_report("authsvc: short blob");
return (NT_STATUS_INVALID_PARAMETER);
}
/*
* We could have "Raw NTLMSSP" here intead of SPNEGO.
*/
if (bcmp(ctx->ctx_irawbuf, "NTLMSSP", 8) == 0) {
rc = smbd_raw_ntlmssp_esfirst(ctx);
return (rc);
}
/*
* Parse the SPNEGO token, check its type.
*/
rc = spnegoInitFromBinary(ctx->ctx_irawbuf,
ctx->ctx_irawlen, &ctx->ctx_itoken);
if (rc != 0) {
smbd_report("authsvc: spnego parse failed");
return (NT_STATUS_INVALID_PARAMETER);
}
rc = spnegoGetTokenType(ctx->ctx_itoken, &ctx->ctx_itoktype);
if (rc != 0) {
smbd_report("authsvc: spnego get token type failed");
return (NT_STATUS_INVALID_PARAMETER);
}
if (ctx->ctx_itoktype != SPNEGO_TOKEN_INIT) {
smbd_report("authsvc: spnego wrong token type %d",
ctx->ctx_itoktype);
return (NT_STATUS_INVALID_PARAMETER);
}
/*
* Figure out which mech type to use. We want to use the
* first of the client's supported mechanisms that we also
* support. Unfortunately, the spnego code does not have an
* interface to walk the token's mech list, so we have to
* ask about each mech type we know and keep track of which
* was earliest in the token's mech list.
*
* Also, skip the Kerberos mechanisms in workgroup mode.
*/
idx = 0;
mh = mech_table;
if (smb_config_get_secmode() != SMB_SECMODE_DOMAIN) {
idx = MECH_TBL_IDX_NTLMSSP;
mh = &mech_table[idx];
}
for (; mh->mh_init != NULL; idx++, mh++) {
if (spnegoIsMechTypeAvailable(ctx->ctx_itoken,
mh->mh_oid, &pref) != 0)
continue;
if (pref < best_pref) {
best_pref = pref;
best_mhidx = idx;
}
}
if (best_mhidx == -1) {
smbd_report("authsvc: no supported spnego mechanism");
return (NT_STATUS_INVALID_PARAMETER);
}
/* Found a mutually agreeable mech. */
mh = &mech_table[best_mhidx];
ctx->ctx_mech_oid = mh->mh_oid;
ctx->ctx_mh_work = mh->mh_work;
ctx->ctx_mh_fini = mh->mh_fini;
rc = mh->mh_init(ctx);
if (rc != 0) {
smbd_report("authsvc: mech init failed");
return (rc);
}
/*
* Common to LSA_MTYPE_ESFIRST, LSA_MTYPE_ESNEXT
*/
rc = smbd_authsvc_escmn(ctx);
return (rc);
}
/*
* Use SMF error codes only on return or exit.
*/
int
main(int argc, char *argv[])
{
sigset_t set;
uid_t uid;
int pfd = -1;
int sigval;
struct rlimit rl;
int orig_limit;
#ifdef FKSMBD
fksmbd_init();
#endif
smbd.s_pname = basename(argv[0]);
openlog(smbd.s_pname, LOG_PID | LOG_NOWAIT, LOG_DAEMON);
if (smbd_setup_options(argc, argv) != 0)
return (SMF_EXIT_ERR_FATAL);
if ((uid = getuid()) != smbd.s_uid) {
#ifdef FKSMBD
/* Can't manipulate privileges in daemonize. */
if (smbd.s_fg == 0) {
smbd.s_fg = 1;
smbd_report("user %d (forced -f)", uid);
}
#else /* FKSMBD */
smbd_report("user %d: %s", uid, strerror(EPERM));
return (SMF_EXIT_ERR_FATAL);
#endif /* FKSMBD */
}
if (is_system_labeled()) {
smbd_report("Trusted Extensions not supported");
return (SMF_EXIT_ERR_FATAL);
}
if (smbd_already_running())
return (SMF_EXIT_OK);
/*
* Raise the file descriptor limit to accommodate simultaneous user
* authentications/file access.
*/
if ((getrlimit(RLIMIT_NOFILE, &rl) == 0) &&
(rl.rlim_cur < rl.rlim_max)) {
orig_limit = rl.rlim_cur;
rl.rlim_cur = rl.rlim_max;
if (setrlimit(RLIMIT_NOFILE, &rl) != 0)
smbd_report("Failed to raise file descriptor limit"
" from %d to %d", orig_limit, rl.rlim_cur);
}
/*
* Block async signals in all threads.
*/
(void) sigemptyset(&set);
(void) sigaddset(&set, SIGHUP);
(void) sigaddset(&set, SIGINT);
(void) sigaddset(&set, SIGQUIT);
(void) sigaddset(&set, SIGPIPE);
(void) sigaddset(&set, SIGTERM);
(void) sigaddset(&set, SIGUSR1);
(void) sigaddset(&set, SIGUSR2);
(void) sigprocmask(SIG_SETMASK, &set, NULL);
if (smbd.s_fg) {
if (smbd_service_init() != 0) {
smbd_report("service initialization failed");
exit(SMF_EXIT_ERR_FATAL);
}
} else {
/*
* "pfd" is a pipe descriptor -- any fatal errors
* during subsequent initialization of the child
* process should be written to this pipe and the
* parent will report this error as the exit status.
*/
pfd = smbd_daemonize_init();
if (smbd_service_init() != 0) {
smbd_report("daemon initialization failed");
exit(SMF_EXIT_ERR_FATAL);
}
smbd_daemonize_fini(pfd, SMF_EXIT_OK);
}
while (!smbd.s_shutting_down) {
sigval = sigwait(&set);
switch (sigval) {
case -1:
syslog(LOG_DEBUG, "sigwait failed: %s",
strerror(errno));
break;
case SIGPIPE:
break;
case SIGHUP:
syslog(LOG_DEBUG, "refresh requested");
smbd_refresh_handler();
break;
case SIGUSR1:
syslog(LOG_DEBUG, "SIGUSR1 ignored");
break;
default:
/*
* Typically SIGINT or SIGTERM.
*/
smbd.s_shutting_down = B_TRUE;
break;
}
}
/*
* Allow termination signals while shutting down.
*/
(void) sigemptyset(&set);
if (smbd.s_fg) {
(void) sigaddset(&set, SIGHUP);
(void) sigaddset(&set, SIGINT);
}
(void) sigaddset(&set, SIGTERM);
(void) sigprocmask(SIG_UNBLOCK, &set, NULL);
smbd_service_fini();
return ((smbd.s_fatal_error) ? SMF_EXIT_ERR_FATAL : SMF_EXIT_OK);
}