From 7509b56b5f59a7aeeb2ad1538ef71cbb8b459948 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Mon, 22 Mar 2010 15:57:31 -0700 Subject: share_info.tdb could use non-canonicalized sharenames. Fix this by moving canonicalization into lib/sharesec.c. Update the db version to 3. Ensures we always find share names with security descriptors attached. Jeremy. --- source3/lib/sharesec.c | 157 ++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 143 insertions(+), 14 deletions(-) (limited to 'source3/lib/sharesec.c') diff --git a/source3/lib/sharesec.c b/source3/lib/sharesec.c index 799d983c82..eef5f39fc0 100644 --- a/source3/lib/sharesec.c +++ b/source3/lib/sharesec.c @@ -26,7 +26,9 @@ static struct db_context *share_db; /* used for share security descriptors */ #define SHARE_DATABASE_VERSION_V1 1 #define SHARE_DATABASE_VERSION_V2 2 /* version id in little endian. */ +#define SHARE_DATABASE_VERSION_V3 3 /* canonicalized sharenames as lower case */ +#define SHARE_SECURITY_DB_KEY_PREFIX_STR "SECDESC/" /* Map generic permissions to file object specific permissions */ extern const struct generic_mapping file_generic_mapping; @@ -37,10 +39,97 @@ static int delete_fn(struct db_record *rec, void *priv) return 0; } +/***************************************************** + Looking for keys of the form: SHARE_SECURITY_DB_KEY_PREFIX_STR + "non lower case str". + If we find one re-write it into a canonical case form. +*****************************************************/ + +static int upgrade_v2_to_v3(struct db_record *rec, void *priv) +{ + size_t prefix_len = strlen(SHARE_SECURITY_DB_KEY_PREFIX_STR); + const char *servicename = NULL; + char *c_servicename = NULL; + char *newkey = NULL; + bool *p_upgrade_ok = (bool *)priv; + NTSTATUS status; + + /* Is there space for a one character sharename ? */ + if (rec->key.dsize <= prefix_len+2) { + return 0; + } + + /* Does it start with the share key prefix ? */ + if (memcmp(rec->key.dptr, SHARE_SECURITY_DB_KEY_PREFIX_STR, + prefix_len) != 0) { + return 0; + } + + /* Is it a null terminated string as a key ? */ + if (rec->key.dptr[rec->key.dsize-1] != '\0') { + return 0; + } + + /* Bytes after the prefix are the sharename string. */ + servicename = (char *)&rec->key.dptr[prefix_len]; + c_servicename = canonicalize_servicename(talloc_tos(), servicename); + if (!c_servicename) { + smb_panic("out of memory upgrading share security db from v2 -> v3"); + } + + if (strcmp(servicename, c_servicename) == 0) { + /* Old and new names match. No canonicalization needed. */ + TALLOC_FREE(c_servicename); + return 0; + } + + /* Oops. Need to canonicalize name, delete old then store new. */ + status = rec->delete_rec(rec); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(1, ("upgrade_v2_to_v3: Failed to delete secdesc for " + "%s: %s\n", rec->key.dptr, nt_errstr(status))); + TALLOC_FREE(c_servicename); + *p_upgrade_ok = false; + return -1; + } else { + DEBUG(10, ("upgrade_v2_to_v3: deleted secdesc for " + "%s\n", rec->key.dptr )); + } + + if (!(newkey = talloc_asprintf(talloc_tos(), + SHARE_SECURITY_DB_KEY_PREFIX_STR "%s", + c_servicename))) { + smb_panic("out of memory upgrading share security db from v2 -> v3"); + } + + status = dbwrap_store(share_db, + string_term_tdb_data(newkey), + rec->value, + TDB_REPLACE); + + if (!NT_STATUS_IS_OK(status)) { + DEBUG(1, ("upgrade_v2_to_v3: Failed to store secdesc for " + "%s: %s\n", c_servicename, nt_errstr(status))); + TALLOC_FREE(c_servicename); + TALLOC_FREE(newkey); + *p_upgrade_ok = false; + return -1; + } else { + DEBUG(10, ("upgrade_v2_to_v3: stored secdesc for " + "%s\n", newkey )); + } + + TALLOC_FREE(newkey); + TALLOC_FREE(c_servicename); + + return 0; +} + bool share_info_db_init(void) { const char *vstring = "INFO/version"; int32 vers_id; + int ret; + bool upgrade_ok = true; if (share_db != NULL) { return True; @@ -55,7 +144,7 @@ bool share_info_db_init(void) } vers_id = dbwrap_fetch_int32(share_db, vstring); - if (vers_id == SHARE_DATABASE_VERSION_V2) { + if (vers_id == SHARE_DATABASE_VERSION_V3) { return true; } @@ -66,7 +155,7 @@ bool share_info_db_init(void) } vers_id = dbwrap_fetch_int32(share_db, vstring); - if (vers_id == SHARE_DATABASE_VERSION_V2) { + if (vers_id == SHARE_DATABASE_VERSION_V3) { /* * Race condition */ @@ -76,6 +165,8 @@ bool share_info_db_init(void) return true; } + /* Move to at least V2. */ + /* Cope with byte-reversed older versions of the db. */ if ((vers_id == SHARE_DATABASE_VERSION_V1) || (IREV(vers_id) == SHARE_DATABASE_VERSION_V1)) { /* Written on a bigendian machine with old fetch_int code. Save as le. */ @@ -89,7 +180,6 @@ bool share_info_db_init(void) } if (vers_id != SHARE_DATABASE_VERSION_V2) { - int ret; ret = share_db->traverse(share_db, delete_fn, NULL); if (ret < 0) { DEBUG(0, ("traverse failed\n")); @@ -102,6 +192,19 @@ bool share_info_db_init(void) } } + /* Finally upgrade to version 3, with canonicalized sharenames. */ + + ret = share_db->traverse(share_db, upgrade_v2_to_v3, &upgrade_ok); + if (ret < 0 || upgrade_ok == false) { + DEBUG(0, ("traverse failed\n")); + goto cancel; + } + if (dbwrap_store_int32(share_db, vstring, + SHARE_DATABASE_VERSION_V3) != 0) { + DEBUG(0, ("dbwrap_store_int32 failed\n")); + goto cancel; + } + if (share_db->transaction_commit(share_db) != 0) { DEBUG(0, ("transaction_commit failed\n")); return false; @@ -159,17 +262,26 @@ SEC_DESC *get_share_security( TALLOC_CTX *ctx, const char *servicename, char *key; SEC_DESC *psd = NULL; TDB_DATA data; + char *c_servicename = canonicalize_servicename(talloc_tos(), servicename); NTSTATUS status; + if (!c_servicename) { + return NULL; + } + if (!share_info_db_init()) { + TALLOC_FREE(c_servicename); return NULL; } - if (!(key = talloc_asprintf(ctx, "SECDESC/%s", servicename))) { + if (!(key = talloc_asprintf(ctx, SHARE_SECURITY_DB_KEY_PREFIX_STR "%s", c_servicename))) { + TALLOC_FREE(c_servicename); DEBUG(0, ("talloc_asprintf failed\n")); return NULL; } + TALLOC_FREE(c_servicename); + data = dbwrap_fetch_bystring(share_db, talloc_tos(), key); TALLOC_FREE(key); @@ -186,11 +298,16 @@ SEC_DESC *get_share_security( TALLOC_CTX *ctx, const char *servicename, if (!NT_STATUS_IS_OK(status)) { DEBUG(0, ("unmarshall_sec_desc failed: %s\n", nt_errstr(status))); - return NULL; + return get_share_security_default(ctx, psize, + GENERIC_ALL_ACCESS); } - if (psd) + if (psd) { *psize = ndr_size_security_descriptor(psd, NULL, 0); + } else { + return get_share_security_default(ctx, psize, + GENERIC_ALL_ACCESS); + } return psd; } @@ -201,17 +318,20 @@ SEC_DESC *get_share_security( TALLOC_CTX *ctx, const char *servicename, bool set_share_security(const char *share_name, SEC_DESC *psd) { - TALLOC_CTX *frame; + TALLOC_CTX *frame = talloc_stackframe(); char *key; bool ret = False; TDB_DATA blob; NTSTATUS status; + char *c_share_name = canonicalize_servicename(frame, share_name); - if (!share_info_db_init()) { - return False; + if (!c_share_name) { + goto out; } - frame = talloc_stackframe(); + if (!share_info_db_init()) { + goto out; + } status = marshall_sec_desc(frame, psd, &blob.dptr, &blob.dsize); @@ -221,7 +341,7 @@ bool set_share_security(const char *share_name, SEC_DESC *psd) goto out; } - if (!(key = talloc_asprintf(frame, "SECDESC/%s", share_name))) { + if (!(key = talloc_asprintf(frame, SHARE_SECURITY_DB_KEY_PREFIX_STR "%s", c_share_name))) { DEBUG(0, ("talloc_asprintf failed\n")); goto out; } @@ -251,13 +371,20 @@ bool delete_share_security(const char *servicename) TDB_DATA kbuf; char *key; NTSTATUS status; + char *c_servicename = canonicalize_servicename(talloc_tos(), servicename); + + if (!c_servicename) { + return NULL; + } if (!share_info_db_init()) { + TALLOC_FREE(c_servicename); return False; } - if (!(key = talloc_asprintf(talloc_tos(), "SECDESC/%s", - servicename))) { + if (!(key = talloc_asprintf(talloc_tos(), SHARE_SECURITY_DB_KEY_PREFIX_STR "%s", + c_servicename))) { + TALLOC_FREE(c_servicename); return False; } kbuf = string_term_tdb_data(key); @@ -265,10 +392,12 @@ bool delete_share_security(const char *servicename) status = dbwrap_trans_delete(share_db, kbuf); if (!NT_STATUS_IS_OK(status)) { DEBUG(0, ("delete_share_security: Failed to delete entry for " - "share %s: %s\n", servicename, nt_errstr(status))); + "share %s: %s\n", c_servicename, nt_errstr(status))); + TALLOC_FREE(c_servicename); return False; } + TALLOC_FREE(c_servicename); return True; } -- cgit