Changeset 740 for vendor/current/source3/smbd/service.c

Timestamp:

Nov 14, 2012, 12:59:34 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to 3.6.0

File:

• vendor/current/source3/smbd/service.c (modified) (48 diffs)

vendor/current/source3/smbd/service.c

@@ -3 +3 @@
    service (connection) opening and closing
    Copyright (C) Andrew Tridgell 1992-1998
-   
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -19 +19 @@
 
 #include "includes.h"
+#include "system/filesys.h"
+#include "../lib/tsocket/tsocket.h"
+#include "smbd/smbd.h"
 #include "smbd/globals.h"
+#include "../librpc/gen_ndr/netlogon.h"
+#include "../libcli/security/security.h"
+#include "printing/pcap.h"
+#include "passdb/lookup_sid.h"
+#include "auth.h"
 
 extern userdom_struct current_user_info;
@@ -25 +33 @@
 static bool canonicalize_connect_path(connection_struct *conn)
 {
-#ifdef REALPATH_TAKES_NULL
         bool ret;
-        char *resolved_name = SMB_VFS_REALPATH(conn,conn->connectpath,NULL);
+        char *resolved_name = SMB_VFS_REALPATH(conn,conn->connectpath);
         if (!resolved_name) {
                 return false;
@@ -34 +41 @@
         SAFE_FREE(resolved_name);
         return ret;
-#else
-        char resolved_name_buf[PATH_MAX+1];
-        char *resolved_name = SMB_VFS_REALPATH(conn,conn->connectpath,resolved_name_buf);
-        if (!resolved_name) {
-                return false;
-        }
-        return set_conn_connectpath(conn,resolved_name);
-#endif /* REALPATH_TAKES_NULL */
 }
 
@@ -62 +61 @@
 
         /* Allocate for strlen + '\0' + possible leading '/' */
-        destname = SMB_MALLOC(strlen(connectpath) + 2);
+        destname = (char *)SMB_MALLOC(strlen(connectpath) + 2);
         if (!destname) {
                 return false;
@@ -184 +183 @@
 
         snum = SNUM(conn);
-  
+
         if (do_chdir &&
             vfs_ChDir(conn,conn->connectpath) != 0 &&
@@ -199 +198 @@
         last_conn = conn;
         last_flags = flags;
-        
+
         /* Obey the client case sensitivity requests - only for clients that support it. */
         switch (lp_casesensitive(snum)) {
@@ -293 +292 @@
                 return -1;
         }
-        
+
         return lp_servicenumber(service);
 
@@ -304 +303 @@
  **/
 
-int find_service(fstring service)
+int find_service(TALLOC_CTX *ctx, const char *service_in, char **p_service_out)
 {
         int iService;
-        struct smbd_server_connection *sconn = smbd_server_conn;
-
-        all_string_sub(service,"\\","/",0);
-
-        iService = lp_servicenumber(service);
+
+        if (!service_in) {
+                return -1;
+        }
+
+        /* First make a copy. */
+        *p_service_out = talloc_strdup(ctx, service_in);
+        if (!*p_service_out) {
+                return -1;
+        }
+
+        all_string_sub(*p_service_out,"\\","/",0);
+
+        iService = lp_servicenumber(*p_service_out);
 
         /* now handle the special case of a home directory */
         if (iService < 0) {
-                char *phome_dir = get_user_home_dir(talloc_tos(), service);
+                char *phome_dir = get_user_home_dir(ctx, *p_service_out);
 
                 if(!phome_dir) {
@@ -322 +330 @@
                          * be a Windows to unix mapped user name.
                          */
-                        if(map_username(sconn, service))
+                        if(map_username(ctx, *p_service_out, p_service_out)) {
+                                if (*p_service_out == NULL) {
+                                        /* Out of memory. */
+                                        return -1;
+                                }
                                 phome_dir = get_user_home_dir(
-                                        talloc_tos(), service);
-                }
-
-                DEBUG(3,("checking for home directory %s gave %s\n",service,
+                                                ctx, *p_service_out);
+                        }
+                }
+
+                DEBUG(3,("checking for home directory %s gave %s\n",*p_service_out,
                         phome_dir?phome_dir:"(NULL)"));
 
-                iService = add_home_service(service,service /* 'username' */, phome_dir);
+                iService = add_home_service(*p_service_out,*p_service_out /* 'username' */, phome_dir);
         }
 
@@ -341 +354 @@
                 }
                 if (iPrinterService >= 0) {
-                        DEBUG(3,("checking whether %s is a valid printer name...\n", service));
-                        if (pcap_printername_ok(service)) {
-                                DEBUG(3,("%s is a valid printer name\n", service));
-                                DEBUG(3,("adding %s as a printer service\n", service));
-                                lp_add_printer(service, iPrinterService);
-                                iService = lp_servicenumber(service);
+                        DEBUG(3,("checking whether %s is a valid printer name...\n",
+                                *p_service_out));
+                        if (pcap_printername_ok(*p_service_out)) {
+                                DEBUG(3,("%s is a valid printer name\n",
+                                        *p_service_out));
+                                DEBUG(3,("adding %s as a printer service\n",
+                                        *p_service_out));
+                                lp_add_printer(*p_service_out, iPrinterService);
+                                iService = lp_servicenumber(*p_service_out);
                                 if (iService < 0) {
-                                        DEBUG(0,("failed to add %s as a printer service!\n", service));
+                                        DEBUG(0,("failed to add %s as a printer service!\n",
+                                                *p_service_out));
                                 }
                         } else {
-                                DEBUG(3,("%s is not a valid printer name\n", service));
+                                DEBUG(3,("%s is not a valid printer name\n",
+                                        *p_service_out));
                         }
                 }
@@ -361 +379 @@
 
         if (iService < 0) {
-                iService = load_registry_service(service);
+                iService = load_registry_service(*p_service_out);
         }
 
@@ -367 +385 @@
         if (iService < 0 && *lp_usershare_path()) {
                 /* Ensure the name is canonicalized. */
-                strlower_m(service);
-                iService = load_usershare_service(service);
+                strlower_m(*p_service_out);
+                iService = load_usershare_service(*p_service_out);
         }
 
@@ -374 +392 @@
         if (iService < 0) {
                 char *pdefservice = lp_defaultservice();
-                if (pdefservice && *pdefservice && !strequal(pdefservice,service) && !strstr_m(service,"..")) {
+                if (pdefservice &&
+                                *pdefservice &&
+                                !strequal(pdefservice, *p_service_out)
+                                && !strstr_m(*p_service_out,"..")) {
                         /*
                          * We need to do a local copy here as lp_defaultservice() 
@@ -381 +402 @@
                          * below. Fix from Josef Hinteregger <joehtg@joehtg.co.at>.
                          */
-                        char *defservice = SMB_STRDUP(pdefservice);
+                        char *defservice = talloc_strdup(ctx, pdefservice);
 
                         if (!defservice) {
@@ -391 +412 @@
                                         strequal(defservice, PRINTERS_NAME) ||
                                         strequal(defservice, "IPC$")) {
-                                SAFE_FREE(defservice);
+                                TALLOC_FREE(defservice);
                                 goto fail;
                         }
 
-                        iService = find_service(defservice);
+                        iService = find_service(ctx, defservice, p_service_out);
+                        if (!*p_service_out) {
+                                TALLOC_FREE(defservice);
+                                iService = -1;
+                                goto fail;
+                        }
                         if (iService >= 0) {
-                                all_string_sub(service, "_","/",0);
-                                iService = lp_add_service(service, iService);
+                                all_string_sub(*p_service_out, "_","/",0);
+                                iService = lp_add_service(*p_service_out, iService);
                         }
-                        SAFE_FREE(defservice);
+                        TALLOC_FREE(defservice);
                 }
         }
@@ -406 +432 @@
         if (iService >= 0) {
                 if (!VALID_SNUM(iService)) {
-                        DEBUG(0,("Invalid snum %d for %s\n",iService, service));
+                        DEBUG(0,("Invalid snum %d for %s\n",iService,
+                                *p_service_out));
                         iService = -1;
                 }
@@ -413 +440 @@
   fail:
 
-        if (iService < 0)
-                DEBUG(3,("find_service() failed to find service %s\n", service));
+        if (iService < 0) {
+                DEBUG(3,("find_service() failed to find service %s\n",
+                        *p_service_out));
+        }
 
         return (iService);
@@ -425 +454 @@
 ****************************************************************************/
 
-static NTSTATUS share_sanity_checks(int snum, fstring dev) 
+static NTSTATUS share_sanity_checks(struct client_address *client_id, int snum,
+                                    fstring dev)
 {
-        
         if (!lp_snum_ok(snum) || 
-            !check_access(smbd_server_fd(), 
-                          lp_hostsallow(snum), lp_hostsdeny(snum))) {    
+            !allow_access(lp_hostsdeny(snum), lp_hostsallow(snum),
+                          client_id->name, client_id->addr)) {
                 return NT_STATUS_ACCESS_DENIED;
         }
@@ -475 +504 @@
 static NTSTATUS find_forced_group(bool force_user,
                                   int snum, const char *username,
-                                  DOM_SID *pgroup_sid,
+                                  struct dom_sid *pgroup_sid,
                                   gid_t *pgid)
 {
         NTSTATUS result = NT_STATUS_NO_SUCH_GROUP;
         TALLOC_CTX *frame = talloc_stackframe();
-        DOM_SID group_sid;
+        struct dom_sid group_sid;
         enum lsa_SidType type;
         char *groupname;
@@ -563 +592 @@
 ****************************************************************************/
 
-static NTSTATUS create_connection_server_info(struct smbd_server_connection *sconn,
+static NTSTATUS create_connection_session_info(struct smbd_server_connection *sconn,
                                               TALLOC_CTX *mem_ctx, int snum,
                                               struct auth_serversupplied_info *vuid_serverinfo,
@@ -590 +619 @@
                 } else {
                         if (!user_ok_token(vuid_serverinfo->unix_name,
-                                           pdb_get_domain(vuid_serverinfo->sam_account),
-                                           vuid_serverinfo->ptok, snum)) {
+                                           vuid_serverinfo->info3->base.domain.string,
+                                           vuid_serverinfo->security_token, snum)) {
                                 DEBUG(2, ("user '%s' (from session setup) not "
                                           "permitted to access this share "
@@ -636 +665 @@
 }
 
+/****************************************************************************
+  set relavent user and group settings corresponding to force user/group
+  configuration for the given snum.
+****************************************************************************/
+
+NTSTATUS set_conn_force_user_group(connection_struct *conn, int snum)
+{
+        NTSTATUS status;
+
+        if (*lp_force_user(snum)) {
+
+                /*
+                 * Replace conn->session_info with a completely faked up one
+                 * from the username we are forced into :-)
+                 */
+
+                char *fuser;
+                struct auth_serversupplied_info *forced_serverinfo;
+
+                fuser = talloc_string_sub(conn, lp_force_user(snum), "%S",
+                                          lp_const_servicename(snum));
+                if (fuser == NULL) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+
+                status = make_serverinfo_from_username(
+                        conn, fuser, conn->session_info->guest,
+                        &forced_serverinfo);
+                if (!NT_STATUS_IS_OK(status)) {
+                        return status;
+                }
+
+                TALLOC_FREE(conn->session_info);
+                conn->session_info = forced_serverinfo;
+
+                conn->force_user = true;
+                DEBUG(3,("Forced user %s\n", fuser));
+        }
+
+        /*
+         * If force group is true, then override
+         * any groupid stored for the connecting user.
+         */
+
+        if (*lp_force_group(snum)) {
+
+                status = find_forced_group(
+                        conn->force_user, snum, conn->session_info->unix_name,
+                        &conn->session_info->security_token->sids[1],
+                        &conn->session_info->utok.gid);
+
+                if (!NT_STATUS_IS_OK(status)) {
+                        return status;
+                }
+
+                /*
+                 * We need to cache this gid, to use within
+                 * change_to_user() separately from the conn->session_info
+                 * struct. We only use conn->session_info directly if
+                 * "force_user" was set.
+                 */
+                conn->force_group_gid = conn->session_info->utok.gid;
+        }
+
+        return NT_STATUS_OK;
+}
 
 /****************************************************************************
@@ -648 +743 @@
                                         NTSTATUS *pstatus)
 {
-        connection_struct *conn;
+        connection_struct *conn = NULL;
         struct smb_filename *smb_fname_cpath = NULL;
         fstring dev;
         int ret;
-        char addr[INET6_ADDRSTRLEN];
+        bool on_err_call_dis_hook = false;
+        bool claimed_connection = false;
+        uid_t effuid;
+        gid_t effgid;
         NTSTATUS status;
 
         fstrcpy(dev, pdev);
 
-        if (NT_STATUS_IS_ERR(*pstatus = share_sanity_checks(snum, dev))) {
-                return NULL;
-        }       
+        *pstatus = share_sanity_checks(&sconn->client_id, snum, dev);
+        if (NT_STATUS_IS_ERR(*pstatus)) {
+                goto err_root_exit;
+        }
 
         conn = conn_new(sconn);
@@ -665 +764 @@
                 DEBUG(0,("Couldn't find free connection.\n"));
                 *pstatus = NT_STATUS_INSUFFICIENT_RESOURCES;
-                return NULL;
+                goto err_root_exit;
         }
 
         conn->params->service = snum;
 
-        status = create_connection_server_info(sconn,
-                conn, snum, vuser ? vuser->server_info : NULL, password,
-                &conn->server_info);
+        status = create_connection_session_info(sconn,
+                conn, snum, vuser ? vuser->session_info : NULL, password,
+                &conn->session_info);
 
         if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(1, ("create_connection_server_info failed: %s\n",
+                DEBUG(1, ("create_connection_session_info failed: %s\n",
                           nt_errstr(status)));
                 *pstatus = status;
-                conn_free(conn);
-                return NULL;
+                goto err_root_exit;
         }
 
@@ -686 +784 @@
         }
 
-        add_session_user(sconn, conn->server_info->unix_name);
-
-        safe_strcpy(conn->client_address,
-                        client_addr(get_client_fd(),addr,sizeof(addr)), 
-                        sizeof(conn->client_address)-1);
+        add_session_user(sconn, conn->session_info->unix_name);
+
         conn->num_files_open = 0;
         conn->lastused = conn->lastused_count = time(NULL);
@@ -718 +813 @@
 
         conn->read_only = lp_readonly(SNUM(conn));
-        conn->admin_user = False;
-
-        if (*lp_force_user(snum)) {
-
-                /*
-                 * Replace conn->server_info with a completely faked up one
-                 * from the username we are forced into :-)
-                 */
-
-                char *fuser;
-                struct auth_serversupplied_info *forced_serverinfo;
-
-                fuser = talloc_string_sub(conn, lp_force_user(snum), "%S",
-                                          lp_servicename(snum));
-                if (fuser == NULL) {
-                        conn_free(conn);
-                        *pstatus = NT_STATUS_NO_MEMORY;
-                        return NULL;
-                }
-
-                status = make_serverinfo_from_username(
-                        conn, fuser, conn->server_info->guest,
-                        &forced_serverinfo);
-                if (!NT_STATUS_IS_OK(status)) {
-                        conn_free(conn);
-                        *pstatus = status;
-                        return NULL;
-                }
-
-                TALLOC_FREE(conn->server_info);
-                conn->server_info = forced_serverinfo;
-
-                conn->force_user = True;
-                DEBUG(3,("Forced user %s\n", fuser));
-        }
-
-        /*
-         * If force group is true, then override
-         * any groupid stored for the connecting user.
-         */
-
-        if (*lp_force_group(snum)) {
-
-                status = find_forced_group(
-                        conn->force_user, snum, conn->server_info->unix_name,
-                        &conn->server_info->ptok->user_sids[1],
-                        &conn->server_info->utok.gid);
-
-                if (!NT_STATUS_IS_OK(status)) {
-                        conn_free(conn);
-                        *pstatus = status;
-                        return NULL;
-                }
-
-                /*
-                 * We need to cache this gid, to use within
-                 * change_to_user() separately from the conn->server_info
-                 * struct. We only use conn->server_info directly if
-                 * "force_user" was set.
-                 */
-                conn->force_group_gid = conn->server_info->utok.gid;
+
+        status = set_conn_force_user_group(conn, snum);
+        if (!NT_STATUS_IS_OK(status)) {
+                conn_free(conn);
+                *pstatus = status;
+                return NULL;
         }
 
@@ -786 +826 @@
                 char *s = talloc_sub_advanced(talloc_tos(),
                                         lp_servicename(SNUM(conn)),
-                                        conn->server_info->unix_name,
+                                        conn->session_info->unix_name,
                                         conn->connectpath,
-                                        conn->server_info->utok.gid,
-                                        conn->server_info->sanitized_username,
-                                        pdb_get_domain(conn->server_info->sam_account),
+                                        conn->session_info->utok.gid,
+                                        conn->session_info->sanitized_username,
+                                        conn->session_info->info3->base.domain.string,
                                         lp_pathname(snum));
                 if (!s) {
-                        conn_free(conn);
                         *pstatus = NT_STATUS_NO_MEMORY;
-                        return NULL;
+                        goto err_root_exit;
                 }
 
                 if (!set_conn_connectpath(conn,s)) {
                         TALLOC_FREE(s);
-                        conn_free(conn);
                         *pstatus = NT_STATUS_NO_MEMORY;
-                        return NULL;
+                        goto err_root_exit;
                 }
                 DEBUG(3,("Connect path is '%s' for service [%s]\n",s,
@@ -816 +854 @@
          */
 
-        {
-                bool can_write = False;
-
-                can_write = share_access_check(conn->server_info->ptok,
-                                               lp_servicename(snum),
-                                               FILE_WRITE_DATA);
-
-                if (!can_write) {
-                        if (!share_access_check(conn->server_info->ptok,
-                                                lp_servicename(snum),
-                                                FILE_READ_DATA)) {
-                                /* No access, read or write. */
-                                DEBUG(0,("make_connection: connection to %s "
-                                         "denied due to security "
-                                         "descriptor.\n",
-                                          lp_servicename(snum)));
-                                conn_free(conn);
-                                *pstatus = NT_STATUS_ACCESS_DENIED;
-                                return NULL;
-                        } else {
-                                conn->read_only = True;
-                        }
+        share_access_check(conn->session_info->security_token,
+                           lp_servicename(snum), MAXIMUM_ALLOWED_ACCESS,
+                           &conn->share_access);
+
+        if ((conn->share_access & FILE_WRITE_DATA) == 0) {
+                if ((conn->share_access & FILE_READ_DATA) == 0) {
+                        /* No access, read or write. */
+                        DEBUG(0,("make_connection: connection to %s "
+                                 "denied due to security "
+                                 "descriptor.\n",
+                                 lp_servicename(snum)));
+                        *pstatus = NT_STATUS_ACCESS_DENIED;
+                        goto err_root_exit;
+                } else {
+                        conn->read_only = True;
                 }
         }
@@ -845 +876 @@
                 DEBUG(0, ("vfs_init failed for service %s\n",
                           lp_servicename(snum)));
-                conn_free(conn);
                 *pstatus = NT_STATUS_BAD_NETWORK_NAME;
-                return NULL;
-        }
-
-        if ((!conn->printer) && (!conn->ipc)) {
-                conn->notify_ctx = notify_init(conn, server_id_self(),
-                                               smbd_messaging_context(),
-                                               smbd_event_context(),
-                                               conn);
+                goto err_root_exit;
         }
 
@@ -872 +895 @@
                 DEBUG(1, ("Max connections (%d) exceeded for %s\n",
                           lp_max_connections(snum), lp_servicename(snum)));
-                conn_free(conn);
                 *pstatus = NT_STATUS_INSUFFICIENT_RESOURCES;
-                return NULL;
-        }  
+                goto err_root_exit;
+        }
 
         /*
          * Get us an entry in the connections db
          */
-        if (!claim_connection(conn, lp_servicename(snum), 0)) {
+        if (!claim_connection(conn, lp_servicename(snum))) {
                 DEBUG(1, ("Could not store connections entry\n"));
-                conn_free(conn);
                 *pstatus = NT_STATUS_INTERNAL_DB_ERROR;
-                return NULL;
-        }  
-
-        /* Invoke VFS make connection hook - must be the first
-           VFS operation we do. */
+                goto err_root_exit;
+        }
+        claimed_connection = true;
+
+        /* Invoke VFS make connection hook - this must be the first
+           filesystem operation that we do. */
 
         if (SMB_VFS_CONNECT(conn, lp_servicename(snum),
-                            conn->server_info->unix_name) < 0) {
+                            conn->session_info->unix_name) < 0) {
                 DEBUG(0,("make_connection: VFS make connection failed!\n"));
-                yield_connection(conn, lp_servicename(snum));
-                conn_free(conn);
                 *pstatus = NT_STATUS_UNSUCCESSFUL;
-                return NULL;
+                goto err_root_exit;
+        }
+
+        /* Any error exit after here needs to call the disconnect hook. */
+        on_err_call_dis_hook = true;
+
+        if ((!conn->printer) && (!conn->ipc)) {
+                conn->notify_ctx = notify_init(conn,
+                                               sconn_server_id(sconn),
+                                               sconn->msg_ctx,
+                                               smbd_event_context(),
+                                               conn);
         }
 
@@ -917 +948 @@
                 char *cmd = talloc_sub_advanced(talloc_tos(),
                                         lp_servicename(SNUM(conn)),
-                                        conn->server_info->unix_name,
+                                        conn->session_info->unix_name,
                                         conn->connectpath,
-                                        conn->server_info->utok.gid,
-                                        conn->server_info->sanitized_username,
-                                        pdb_get_domain(conn->server_info->sam_account),
+                                        conn->session_info->utok.gid,
+                                        conn->session_info->sanitized_username,
+                                        conn->session_info->info3->base.domain.string,
                                         lp_rootpreexec(snum));
                 DEBUG(5,("cmd=%s\n",cmd));
@@ -929 +960 @@
                         DEBUG(1,("root preexec gave %d - failing "
                                  "connection\n", ret));
-                        SMB_VFS_DISCONNECT(conn);
-                        yield_connection(conn, lp_servicename(snum));
-                        conn_free(conn);
                         *pstatus = NT_STATUS_ACCESS_DENIED;
-                        return NULL;
+                        goto err_root_exit;
                 }
         }
@@ -941 +969 @@
                 /* No point continuing if they fail the basic checks */
                 DEBUG(0,("Can't become connected user!\n"));
-                SMB_VFS_DISCONNECT(conn);
-                yield_connection(conn, lp_servicename(snum));
-                conn_free(conn);
                 *pstatus = NT_STATUS_LOGON_FAILURE;
-                return NULL;
-        }
+                goto err_root_exit;
+        }
+
+        effuid = geteuid();
+        effgid = getegid();
 
         /* Remember that a different vuid can connect later without these
          * checks... */
-        
+
         /* Preexecs are done here as they might make the dir we are to ChDir
          * to below */
@@ -958 +986 @@
                 char *cmd = talloc_sub_advanced(talloc_tos(),
                                         lp_servicename(SNUM(conn)),
-                                        conn->server_info->unix_name,
+                                        conn->session_info->unix_name,
                                         conn->connectpath,
-                                        conn->server_info->utok.gid,
-                                        conn->server_info->sanitized_username,
-                                        pdb_get_domain(conn->server_info->sam_account),
+                                        conn->session_info->utok.gid,
+                                        conn->session_info->sanitized_username,
+                                        conn->session_info->info3->base.domain.string,
                                         lp_preexec(snum));
                 ret = smbrun(cmd,NULL);
@@ -973 +1001 @@
                 }
         }
+
+#ifdef WITH_FAKE_KASERVER
+        if (lp_afs_share(snum)) {
+                afs_login(conn);
+        }
+#endif
+
+        /*
+         * we've finished with the user stuff - go back to root
+         * so the SMB_VFS_STAT call will only fail on path errors,
+         * not permission problems.
+         */
+        change_to_root_user();
+/* ROOT Activites: */
 
         /*
@@ -992 +1034 @@
         }
 
-#ifdef WITH_FAKE_KASERVER
-        if (lp_afs_share(snum)) {
-                afs_login(conn);
-        }
-#endif
-        
         /* Add veto/hide lists */
         if (!IS_IPC(conn) && !IS_PRINT(conn)) {
@@ -1006 +1042 @@
                                 lp_aio_write_behind(snum));
         }
-        
         status = create_synthetic_smb_fname(talloc_tos(), conn->connectpath,
                                             NULL, NULL, &smb_fname_cpath);
@@ -1019 +1054 @@
            I have disabled this chdir check (tridge) */
         /* the alternative is just to check the directory exists */
+
         if ((ret = SMB_VFS_STAT(conn, smb_fname_cpath)) != 0 ||
             !S_ISDIR(smb_fname_cpath->st.st_ex_mode)) {
@@ -1038 +1074 @@
         string_set(&conn->origpath,conn->connectpath);
 
-#if SOFTLINK_OPTIMISATION
-        /* resolve any soft links early if possible */
-        if (vfs_ChDir(conn,conn->connectpath) == 0) {
-                TALLOC_CTX *ctx = talloc_tos();
-                char *s = vfs_GetWd(ctx,s);
-                if (!s) {
-                        *status = map_nt_error_from_unix(errno);
-                        goto err_root_exit;
-                }
-                if (!set_conn_connectpath(conn,s)) {
-                        *status = NT_STATUS_NO_MEMORY;
-                        goto err_root_exit;
-                }
-                vfs_ChDir(conn,conn->connectpath);
-        }
-#endif
-
         /* Figure out the characteristics of the underlying filesystem. This
          * assumes that all the filesystem mounted withing a share path have
@@ -1070 +1089 @@
         if( DEBUGLVL( IS_IPC(conn) ? 3 : 1 ) ) {
                 dbgtext( "%s (%s) ", get_remote_machine_name(),
-                         conn->client_address );
-                dbgtext( "%s", srv_is_signing_active(smbd_server_conn) ? "signed " : "");
+                         conn->sconn->client_id.addr );
+                dbgtext( "%s", srv_is_signing_active(sconn) ? "signed " : "");
                 dbgtext( "connect to service %s ", lp_servicename(snum) );
                 dbgtext( "initially as user %s ",
-                         conn->server_info->unix_name );
-                dbgtext( "(uid=%d, gid=%d) ", (int)geteuid(), (int)getegid() );
+                         conn->session_info->unix_name );
+                dbgtext( "(uid=%d, gid=%d) ", (int)effuid, (int)effgid );
                 dbgtext( "(pid %d)\n", (int)sys_getpid() );
         }
 
-        /* we've finished with the user stuff - go back to root */
-        change_to_root_user();
         return(conn);
 
   err_root_exit:
         TALLOC_FREE(smb_fname_cpath);
-        change_to_root_user();
-        /* Call VFS disconnect hook */
-        SMB_VFS_DISCONNECT(conn);
-        yield_connection(conn, lp_servicename(snum));
-        conn_free(conn);
+        /* We must exit this function as root. */
+        if (geteuid() != 0) {
+                change_to_root_user();
+        }
+        if (on_err_call_dis_hook) {
+                /* Call VFS disconnect hook */
+                SMB_VFS_DISCONNECT(conn);
+        }
+        if (claimed_connection) {
+                yield_connection(conn, lp_servicename(snum));
+        }
+        if (conn) {
+                conn_free(conn);
+        }
         return NULL;
 }
@@ -1106 +1132 @@
         uid_t euid;
         user_struct *vuser = NULL;
-        fstring service;
+        char *service = NULL;
         fstring dev;
         int snum = -1;
-        char addr[INET6_ADDRSTRLEN];
 
         fstrcpy(dev, pdev);
@@ -1166 +1191 @@
                          * current_user_info.smb_name as the username.  */
                         if (*current_user_info.smb_name) {
-                                fstring unix_username;
-                                fstrcpy(unix_username,
-                                        current_user_info.smb_name);
-                                map_username(sconn, unix_username);
-                                snum = find_service(unix_username);
-                        } 
+                                char *unix_username = NULL;
+                                (void)map_username(talloc_tos(),
+                                                current_user_info.smb_name,
+                                                &unix_username);
+                                snum = find_service(talloc_tos(),
+                                                unix_username,
+                                                &unix_username);
+                                if (!unix_username) {
+                                        *status = NT_STATUS_NO_MEMORY;
+                                }
+                                return NULL;
+                        }
                         if (snum != -1) {
                                 DEBUG(5, ("making a connection to 'homes' "
@@ -1193 +1224 @@
                                             dev, status);
         }
-        
-        fstrcpy(service, service_in);
+
+        service = talloc_strdup(talloc_tos(), service_in);
+        if (!service) {
+                *status = NT_STATUS_NO_MEMORY;
+                return NULL;
+        }
 
         strlower_m(service);
 
-        snum = find_service(service);
+        snum = find_service(talloc_tos(), service, &service);
+        if (!service) {
+                *status = NT_STATUS_NO_MEMORY;
+                return NULL;
+        }
 
         if (snum < 0) {
@@ -1210 +1249 @@
                 DEBUG(3,("%s (%s) couldn't find service %s\n",
                         get_remote_machine_name(),
-                        client_addr(get_client_fd(),addr,sizeof(addr)),
+                        tsocket_address_string(
+                                sconn->remote_address, talloc_tos()),
                         service));
                 *status = NT_STATUS_BAD_NETWORK_NAME;
@@ -1248 +1288 @@
         DEBUG(IS_IPC(conn)?3:1, ("%s (%s) closed connection to service %s\n",
                                  get_remote_machine_name(),
-                                 conn->client_address,
+                                 conn->sconn->client_id.addr,
                                  lp_servicename(SNUM(conn))));
 
@@ -1264 +1304 @@
                 char *cmd = talloc_sub_advanced(talloc_tos(),
                                         lp_servicename(SNUM(conn)),
-                                        conn->server_info->unix_name,
+                                        conn->session_info->unix_name,
                                         conn->connectpath,
-                                        conn->server_info->utok.gid,
-                                        conn->server_info->sanitized_username,
-                                        pdb_get_domain(conn->server_info->sam_account),
+                                        conn->session_info->utok.gid,
+                                        conn->session_info->sanitized_username,
+                                        conn->session_info->info3->base.domain.string,
                                         lp_postexec(SNUM(conn)));
                 smbrun(cmd,NULL);
@@ -1280 +1320 @@
                 char *cmd = talloc_sub_advanced(talloc_tos(),
                                         lp_servicename(SNUM(conn)),
-                                        conn->server_info->unix_name,
+                                        conn->session_info->unix_name,
                                         conn->connectpath,
-                                        conn->server_info->utok.gid,
-                                        conn->server_info->sanitized_username,
-                                        pdb_get_domain(conn->server_info->sam_account),
+                                        conn->session_info->utok.gid,
+                                        conn->session_info->sanitized_username,
+                                        conn->session_info->info3->base.domain.string,
                                         lp_rootpostexec(SNUM(conn)));
                 smbrun(cmd,NULL);