From 7509b56b5f59a7aeeb2ad1538ef71cbb8b459948 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Mon, 22 Mar 2010 15:57:31 -0700 Subject: share_info.tdb could use non-canonicalized sharenames. Fix this by moving canonicalization into lib/sharesec.c. Update the db version to 3. Ensures we always find share names with security descriptors attached. Jeremy. --- source3/include/proto.h | 1 + source3/lib/sharesec.c | 157 ++++++++++++++++++++++++++++++++++++++++++----- source3/param/loadparm.c | 12 ++-- 3 files changed, 150 insertions(+), 20 deletions(-) (limited to 'source3') diff --git a/source3/include/proto.h b/source3/include/proto.h index 346da39749..403b96ac8f 100644 --- a/source3/include/proto.h +++ b/source3/include/proto.h @@ -4275,6 +4275,7 @@ unsigned long lp_parm_ulong(int snum, const char *type, const char *option, unsi bool lp_parm_bool(int snum, const char *type, const char *option, bool def); int lp_parm_enum(int snum, const char *type, const char *option, const struct enum_list *_enum, int def); +char *canonicalize_servicename(TALLOC_CTX *ctx, const char *src); bool lp_add_home(const char *pszHomename, int iDefaultService, const char *user, const char *pszHomedir); int lp_add_service(const char *pszService, int iDefaultService); diff --git a/source3/lib/sharesec.c b/source3/lib/sharesec.c index 799d983c82..eef5f39fc0 100644 --- a/source3/lib/sharesec.c +++ b/source3/lib/sharesec.c @@ -26,7 +26,9 @@ static struct db_context *share_db; /* used for share security descriptors */ #define SHARE_DATABASE_VERSION_V1 1 #define SHARE_DATABASE_VERSION_V2 2 /* version id in little endian. */ +#define SHARE_DATABASE_VERSION_V3 3 /* canonicalized sharenames as lower case */ +#define SHARE_SECURITY_DB_KEY_PREFIX_STR "SECDESC/" /* Map generic permissions to file object specific permissions */ extern const struct generic_mapping file_generic_mapping; @@ -37,10 +39,97 @@ static int delete_fn(struct db_record *rec, void *priv) return 0; } +/***************************************************** + Looking for keys of the form: SHARE_SECURITY_DB_KEY_PREFIX_STR + "non lower case str". + If we find one re-write it into a canonical case form. +*****************************************************/ + +static int upgrade_v2_to_v3(struct db_record *rec, void *priv) +{ + size_t prefix_len = strlen(SHARE_SECURITY_DB_KEY_PREFIX_STR); + const char *servicename = NULL; + char *c_servicename = NULL; + char *newkey = NULL; + bool *p_upgrade_ok = (bool *)priv; + NTSTATUS status; + + /* Is there space for a one character sharename ? */ + if (rec->key.dsize <= prefix_len+2) { + return 0; + } + + /* Does it start with the share key prefix ? */ + if (memcmp(rec->key.dptr, SHARE_SECURITY_DB_KEY_PREFIX_STR, + prefix_len) != 0) { + return 0; + } + + /* Is it a null terminated string as a key ? */ + if (rec->key.dptr[rec->key.dsize-1] != '\0') { + return 0; + } + + /* Bytes after the prefix are the sharename string. */ + servicename = (char *)&rec->key.dptr[prefix_len]; + c_servicename = canonicalize_servicename(talloc_tos(), servicename); + if (!c_servicename) { + smb_panic("out of memory upgrading share security db from v2 -> v3"); + } + + if (strcmp(servicename, c_servicename) == 0) { + /* Old and new names match. No canonicalization needed. */ + TALLOC_FREE(c_servicename); + return 0; + } + + /* Oops. Need to canonicalize name, delete old then store new. */ + status = rec->delete_rec(rec); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(1, ("upgrade_v2_to_v3: Failed to delete secdesc for " + "%s: %s\n", rec->key.dptr, nt_errstr(status))); + TALLOC_FREE(c_servicename); + *p_upgrade_ok = false; + return -1; + } else { + DEBUG(10, ("upgrade_v2_to_v3: deleted secdesc for " + "%s\n", rec->key.dptr )); + } + + if (!(newkey = talloc_asprintf(talloc_tos(), + SHARE_SECURITY_DB_KEY_PREFIX_STR "%s", + c_servicename))) { + smb_panic("out of memory upgrading share security db from v2 -> v3"); + } + + status = dbwrap_store(share_db, + string_term_tdb_data(newkey), + rec->value, + TDB_REPLACE); + + if (!NT_STATUS_IS_OK(status)) { + DEBUG(1, ("upgrade_v2_to_v3: Failed to store secdesc for " + "%s: %s\n", c_servicename, nt_errstr(status))); + TALLOC_FREE(c_servicename); + TALLOC_FREE(newkey); + *p_upgrade_ok = false; + return -1; + } else { + DEBUG(10, ("upgrade_v2_to_v3: stored secdesc for " + "%s\n", newkey )); + } + + TALLOC_FREE(newkey); + TALLOC_FREE(c_servicename); + + return 0; +} + bool share_info_db_init(void) { const char *vstring = "INFO/version"; int32 vers_id; + int ret; + bool upgrade_ok = true; if (share_db != NULL) { return True; @@ -55,7 +144,7 @@ bool share_info_db_init(void) } vers_id = dbwrap_fetch_int32(share_db, vstring); - if (vers_id == SHARE_DATABASE_VERSION_V2) { + if (vers_id == SHARE_DATABASE_VERSION_V3) { return true; } @@ -66,7 +155,7 @@ bool share_info_db_init(void) } vers_id = dbwrap_fetch_int32(share_db, vstring); - if (vers_id == SHARE_DATABASE_VERSION_V2) { + if (vers_id == SHARE_DATABASE_VERSION_V3) { /* * Race condition */ @@ -76,6 +165,8 @@ bool share_info_db_init(void) return true; } + /* Move to at least V2. */ + /* Cope with byte-reversed older versions of the db. */ if ((vers_id == SHARE_DATABASE_VERSION_V1) || (IREV(vers_id) == SHARE_DATABASE_VERSION_V1)) { /* Written on a bigendian machine with old fetch_int code. Save as le. */ @@ -89,7 +180,6 @@ bool share_info_db_init(void) } if (vers_id != SHARE_DATABASE_VERSION_V2) { - int ret; ret = share_db->traverse(share_db, delete_fn, NULL); if (ret < 0) { DEBUG(0, ("traverse failed\n")); @@ -102,6 +192,19 @@ bool share_info_db_init(void) } } + /* Finally upgrade to version 3, with canonicalized sharenames. */ + + ret = share_db->traverse(share_db, upgrade_v2_to_v3, &upgrade_ok); + if (ret < 0 || upgrade_ok == false) { + DEBUG(0, ("traverse failed\n")); + goto cancel; + } + if (dbwrap_store_int32(share_db, vstring, + SHARE_DATABASE_VERSION_V3) != 0) { + DEBUG(0, ("dbwrap_store_int32 failed\n")); + goto cancel; + } + if (share_db->transaction_commit(share_db) != 0) { DEBUG(0, ("transaction_commit failed\n")); return false; @@ -159,17 +262,26 @@ SEC_DESC *get_share_security( TALLOC_CTX *ctx, const char *servicename, char *key; SEC_DESC *psd = NULL; TDB_DATA data; + char *c_servicename = canonicalize_servicename(talloc_tos(), servicename); NTSTATUS status; + if (!c_servicename) { + return NULL; + } + if (!share_info_db_init()) { + TALLOC_FREE(c_servicename); return NULL; } - if (!(key = talloc_asprintf(ctx, "SECDESC/%s", servicename))) { + if (!(key = talloc_asprintf(ctx, SHARE_SECURITY_DB_KEY_PREFIX_STR "%s", c_servicename))) { + TALLOC_FREE(c_servicename); DEBUG(0, ("talloc_asprintf failed\n")); return NULL; } + TALLOC_FREE(c_servicename); + data = dbwrap_fetch_bystring(share_db, talloc_tos(), key); TALLOC_FREE(key); @@ -186,11 +298,16 @@ SEC_DESC *get_share_security( TALLOC_CTX *ctx, const char *servicename, if (!NT_STATUS_IS_OK(status)) { DEBUG(0, ("unmarshall_sec_desc failed: %s\n", nt_errstr(status))); - return NULL; + return get_share_security_default(ctx, psize, + GENERIC_ALL_ACCESS); } - if (psd) + if (psd) { *psize = ndr_size_security_descriptor(psd, NULL, 0); + } else { + return get_share_security_default(ctx, psize, + GENERIC_ALL_ACCESS); + } return psd; } @@ -201,17 +318,20 @@ SEC_DESC *get_share_security( TALLOC_CTX *ctx, const char *servicename, bool set_share_security(const char *share_name, SEC_DESC *psd) { - TALLOC_CTX *frame; + TALLOC_CTX *frame = talloc_stackframe(); char *key; bool ret = False; TDB_DATA blob; NTSTATUS status; + char *c_share_name = canonicalize_servicename(frame, share_name); - if (!share_info_db_init()) { - return False; + if (!c_share_name) { + goto out; } - frame = talloc_stackframe(); + if (!share_info_db_init()) { + goto out; + } status = marshall_sec_desc(frame, psd, &blob.dptr, &blob.dsize); @@ -221,7 +341,7 @@ bool set_share_security(const char *share_name, SEC_DESC *psd) goto out; } - if (!(key = talloc_asprintf(frame, "SECDESC/%s", share_name))) { + if (!(key = talloc_asprintf(frame, SHARE_SECURITY_DB_KEY_PREFIX_STR "%s", c_share_name))) { DEBUG(0, ("talloc_asprintf failed\n")); goto out; } @@ -251,13 +371,20 @@ bool delete_share_security(const char *servicename) TDB_DATA kbuf; char *key; NTSTATUS status; + char *c_servicename = canonicalize_servicename(talloc_tos(), servicename); + + if (!c_servicename) { + return NULL; + } if (!share_info_db_init()) { + TALLOC_FREE(c_servicename); return False; } - if (!(key = talloc_asprintf(talloc_tos(), "SECDESC/%s", - servicename))) { + if (!(key = talloc_asprintf(talloc_tos(), SHARE_SECURITY_DB_KEY_PREFIX_STR "%s", + c_servicename))) { + TALLOC_FREE(c_servicename); return False; } kbuf = string_term_tdb_data(key); @@ -265,10 +392,12 @@ bool delete_share_security(const char *servicename) status = dbwrap_trans_delete(share_db, kbuf); if (!NT_STATUS_IS_OK(status)) { DEBUG(0, ("delete_share_security: Failed to delete entry for " - "share %s: %s\n", servicename, nt_errstr(status))); + "share %s: %s\n", c_servicename, nt_errstr(status))); + TALLOC_FREE(c_servicename); return False; } + TALLOC_FREE(c_servicename); return True; } diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c index a6e096e09f..9e9930f7d4 100644 --- a/source3/param/loadparm.c +++ b/source3/param/loadparm.c @@ -5792,7 +5792,6 @@ static void init_copymap(struct service *pservice); static bool hash_a_service(const char *name, int number); static void free_service_byindex(int iService); static void free_param_opts(struct param_opt_struct **popts); -static char * canonicalize_servicename(const char *name); static void show_parameter(int parmIndex); static bool is_synonym_of(int parm1, int parm2, bool *inverse); @@ -6117,6 +6116,7 @@ static void free_service_byindex(int idx) if (ServicePtrs[idx]->szService) { char *canon_name = canonicalize_servicename( + talloc_tos(), ServicePtrs[idx]->szService ); dbwrap_delete_bystring(ServiceHash, canon_name ); @@ -6208,7 +6208,7 @@ static int add_a_service(const struct service *pservice, const char *name) Convert a string to uppercase and remove whitespaces. ***************************************************************************/ -static char *canonicalize_servicename(const char *src) +char *canonicalize_servicename(TALLOC_CTX *ctx, const char *src) { char *result; @@ -6217,7 +6217,7 @@ static char *canonicalize_servicename(const char *src) return NULL; } - result = talloc_strdup(talloc_tos(), src); + result = talloc_strdup(ctx, src); SMB_ASSERT(result != NULL); strlower_m(result); @@ -6244,7 +6244,7 @@ static bool hash_a_service(const char *name, int idx) DEBUG(10,("hash_a_service: hashing index %d for service name %s\n", idx, name)); - canon_name = canonicalize_servicename( name ); + canon_name = canonicalize_servicename(talloc_tos(), name ); dbwrap_store_bystring(ServiceHash, canon_name, make_tdb_data((uint8 *)&idx, sizeof(idx)), @@ -6751,7 +6751,7 @@ static int getservicebyname(const char *pszServiceName, struct service *pservice return -1; } - canon_name = canonicalize_servicename(pszServiceName); + canon_name = canonicalize_servicename(talloc_tos(), pszServiceName); data = dbwrap_fetch_bystring(ServiceHash, canon_name, canon_name); @@ -8732,7 +8732,7 @@ static int process_usershare_file(const char *dir_name, const char *file_name, i } { - char *canon_name = canonicalize_servicename(service_name); + char *canon_name = canonicalize_servicename(talloc_tos(), service_name); TDB_DATA data = dbwrap_fetch_bystring( ServiceHash, canon_name, canon_name); -- cgit