Fix bug 8710 - connections.tdb - major leak with SMB2.

Ensure the cnum used to claim the connection for SMB2 is the
id that will be used for the SMB2 tcon. Based on code from
Ira Cooper <ira@wakeful.net>.

Autobuild-User: Jeremy Allison <jra@samba.org>
Autobuild-Date: Wed Jan 18 23:14:32 CET 2012 on sn-devel-104

1 files changed, 71 insertions, 17 deletions

diff --git a/source3/smbd/service.c b/source3/smbd/service.c
index 6d6f9637ed..4d55977ad2 100644
--- a/source3/smbd/service.c
+++ b/source3/smbd/service.c
@@ -527,13 +527,13 @@ NTSTATUS set_conn_force_user_group(connection_struct *conn, int snum)
   connecting user if appropriate.
 ****************************************************************************/
 
-connection_struct *make_connection_snum(struct smbd_server_connection *sconn,
+static connection_struct *make_connection_snum(struct smbd_server_connection *sconn,
+					connection_struct *conn,
 					int snum, user_struct *vuser,
 					DATA_BLOB password,
 					const char *pdev,
 					NTSTATUS *pstatus)
 {
-	connection_struct *conn = NULL;
 	struct smb_filename *smb_fname_cpath = NULL;
 	fstring dev;
 	int ret;
@@ -553,13 +553,6 @@ connection_struct *make_connection_snum(struct smbd_server_connection *sconn,
 		goto err_root_exit;
 	}
 
-	conn = conn_new(sconn);
-	if (!conn) {
-		DEBUG(0,("Couldn't find free connection.\n"));
-		*pstatus = NT_STATUS_INSUFFICIENT_RESOURCES;
-		goto err_root_exit;
-	}
-
 	conn->params->service = snum;
 
 	status = create_connection_session_info(sconn,
@@ -609,7 +602,6 @@ connection_struct *make_connection_snum(struct smbd_server_connection *sconn,
 
 	status = set_conn_force_user_group(conn, snum);
 	if (!NT_STATUS_IS_OK(status)) {
-		conn_free(conn);
 		*pstatus = status;
 		return NULL;
 	}
@@ -907,14 +899,76 @@ connection_struct *make_connection_snum(struct smbd_server_connection *sconn,
 	if (claimed_connection) {
 		yield_connection(conn, lp_servicename(snum));
 	}
-	if (conn) {
+	return NULL;
+}
+
+/****************************************************************************
+ Make a connection to a service from SMB1. Internal interface.
+****************************************************************************/
+
+static connection_struct *make_connection_smb1(struct smbd_server_connection *sconn,
+					int snum, user_struct *vuser,
+					DATA_BLOB password,
+					const char *pdev,
+					NTSTATUS *pstatus)
+{
+	connection_struct *ret_conn = NULL;
+	connection_struct *conn = conn_new(sconn);
+	if (!conn) {
+		DEBUG(0,("make_connection_smb1: Couldn't find free connection.\n"));
+		*pstatus = NT_STATUS_INSUFFICIENT_RESOURCES;
+		return NULL;
+	}
+	ret_conn = make_connection_snum(sconn,
+					conn,
+					snum,
+					vuser,
+                                        password,
+					pdev,
+					pstatus);
+	if (ret_conn != conn) {
 		conn_free(conn);
+		return NULL;
 	}
-	return NULL;
+	return conn;
+}
+
+/****************************************************************************
+ Make a connection to a service from SMB2. External SMB2 interface.
+ We must set cnum before claiming connection.
+****************************************************************************/
+
+connection_struct *make_connection_smb2(struct smbd_server_connection *sconn,
+					struct smbd_smb2_tcon *tcon,
+					user_struct *vuser,
+					DATA_BLOB password,
+					const char *pdev,
+					NTSTATUS *pstatus)
+{
+	connection_struct *ret_conn = NULL;
+	connection_struct *conn = conn_new(sconn);
+	if (!conn) {
+		DEBUG(0,("make_connection_smb2: Couldn't find free connection.\n"));
+		*pstatus = NT_STATUS_INSUFFICIENT_RESOURCES;
+		return NULL;
+	}
+	conn->cnum = tcon->tid;
+	ret_conn = make_connection_snum(sconn,
+					conn,
+					tcon->snum,
+					vuser,
+                                        password,
+					pdev,
+					pstatus);
+	if (ret_conn != conn) {
+		conn_free(conn);
+		return NULL;
+	}
+	return conn;
 }
 
 /****************************************************************************
- Make a connection to a service.
+ Make a connection to a service. External SMB1 interface.
  *
  * @param service 
 ****************************************************************************/
@@ -977,7 +1031,7 @@ connection_struct *make_connection(struct smbd_server_connection *sconn,
 			}
 			DEBUG(5, ("making a connection to [homes] service "
 				  "created at session setup time\n"));
-			return make_connection_snum(sconn,
+			return make_connection_smb1(sconn,
 						    vuser->homes_snum,
 						    vuser, no_pw, 
 						    dev, status);
@@ -1001,7 +1055,7 @@ connection_struct *make_connection(struct smbd_server_connection *sconn,
 				DEBUG(5, ("making a connection to 'homes' "
 					  "service %s based on "
 					  "security=share\n", service_in));
-				return make_connection_snum(sconn,
+				return make_connection_smb1(sconn,
 							    snum, NULL,
 							    password,
 							    dev, status);
@@ -1013,7 +1067,7 @@ connection_struct *make_connection(struct smbd_server_connection *sconn,
 		DATA_BLOB no_pw = data_blob_null;
 		DEBUG(5, ("making a connection to 'homes' service [%s] "
 			  "created at session setup time\n", service_in));
-		return make_connection_snum(sconn,
+		return make_connection_smb1(sconn,
 					    vuser->homes_snum,
 					    vuser, no_pw, 
 					    dev, status);
@@ -1061,7 +1115,7 @@ connection_struct *make_connection(struct smbd_server_connection *sconn,
 
 	DEBUG(5, ("making a connection to 'normal' service %s\n", service));
 
-	return make_connection_snum(sconn, snum, vuser,
+	return make_connection_smb1(sconn, snum, vuser,
 				    password,
 				    dev, status);
 }