pastebin - collaborative debugging tool
nrubsig.kpaste.net RSS


ACL work, backup 2024-06-18
Posted by Anonymous on Tue 18th Jun 2024 16:13
raw | new post
modification of post by Anonymous (view diff)

  1. diff --git a/daemon/acl.c b/daemon/acl.c
  2. index 0aff8d2..f14714d 100644
  3. --- a/daemon/acl.c
  4. +++ b/daemon/acl.c
  5. @@ -41,7 +41,10 @@
  6.  /* Local prototypes */
  7.  static void map_winace2nfs4aceflags(BYTE win_aceflags, uint32_t *nfs4_aceflags);
  8.  static void map_nfs4aceflags2winaceflags(uint32_t nfs4_aceflags, DWORD *win_aceflags);
  9. -
  10. +static void map_winaccessmask2nfs4acemask(ACCESS_MASK win_mask,
  11. +    int file_type, uint32_t *nfs4_mask);
  12. +static void map_nfs4acemask2winaccessmask(uint32_t nfs4_mask,
  13. +    int file_type, ACCESS_MASK *win_mask);
  14.  
  15.  static int parse_getacl(unsigned char *buffer, uint32_t length,
  16.                          nfs41_upcall *upcall)
  17. @@ -161,17 +164,28 @@ static int convert_nfs4acl_2_dacl(nfs41_daemon_globals *nfs41dg,
  18.  
  19.          for (i = 0; i < acl->count; i++) {
  20.              win_aceflags = 0;
  21. +            mask = 0;
  22.  
  23. -            // nfs4 acemask should be exactly the same as file access mask
  24. -            mask = acl->aces[i].acemask;
  25. -            map_nfs4aceflags2winaceflags(acl->aces[i].aceflag, &win_aceflags);
  26. +            map_nfs4aceflags2winaceflags(acl->aces[i].aceflag,
  27. +                &win_aceflags);
  28. +            map_nfs4acemask2winaccessmask(acl->aces[i].acemask,
  29. +                file_type, &mask);
  30.  
  31. -            DPRINTF(ACLLVL, ("aces[%d].who='%s': "
  32. -                "access mask=0x%x, acetype='%s', win_aceflags=0x%x\n",
  33. +            if (DPRINTF_LEVEL_ENABLED(ACLLVL)) {
  34. +                dprintf_out("nfs2win: acl->aces[%d].who='%s': "
  35. +                    "acetype='%s', "
  36. +                    "nfs_acemask=0x%lx, win_mask=0x%lx, "
  37. +                    "win_aceflags=0x%lx\n",
  38.                      i, acl->aces[i].who,
  39. -                (int)mask,
  40. -                acl->aces[i].acetype?"DENIED ACE":"ALLOWED ACE",
  41. -                (int)win_aceflags));
  42. +                    (acl->aces[i].acetype?"DENIED ACE":"ALLOWED ACE"),
  43. +                    (long)acl->aces[i].acemask,
  44. +                    (long)mask,
  45. +                    (long)win_aceflags);
  46. +
  47. +                print_nfs_access_mask(acl->aces[i].who,
  48. +                    acl->aces[i].acemask);
  49. +                print_windows_access_mask(acl->aces[i].who, mask);
  50. +            }
  51.  
  52.              if (acl->aces[i].acetype == ACE4_ACCESS_ALLOWED_ACE_TYPE) {
  53.                  status = AddAccessAllowedAceEx(dacl, ACL_REVISION, win_aceflags, mask, sids[i]);
  54. @@ -238,7 +252,8 @@ static int handle_getacl(void *daemon_context, nfs41_upcall *upcall)
  55.      char owner[NFS4_OPAQUE_LIMIT+1], group[NFS4_OPAQUE_LIMIT+1];
  56.      nfsacl41 acl = { 0 };
  57.  
  58. -    DPRINTF(ACLLVL, ("--> handle_getacl()\n"));
  59. +    DPRINTF(ACLLVL, ("--> handle_getacl(state->path.path='%s')\n",
  60. +        state->path.path));
  61.  
  62.      if (args->query & DACL_SECURITY_INFORMATION) {
  63.  use_nfs41_getattr:
  64. @@ -524,38 +539,209 @@ static void map_nfs4aceflags2winaceflags(uint32_t nfs4_aceflags, DWORD *win_acef
  65.          (int)nfs4_aceflags, (int)*win_aceflags));
  66.  }
  67.  
  68. -static void map_winaccessmask2nfs4acemask(ACCESS_MASK mask, int file_type, uint32_t *nfs4_mask)
  69. +static
  70. +void map_winaccessmask2nfs4acemask(ACCESS_MASK win_mask,
  71. +    int file_type, uint32_t *nfs4_mask)
  72.  {
  73. -    DPRINTF(ACLLVL,
  74. -        ("--> map_winaccessmask2nfs4acemask(mask=0x%x)\n",
  75. -        (int)mask));
  76. -    if (DPRINTF_LEVEL_ENABLED(ACLLVL)) {
  77. -        print_windows_access_mask(mask);
  78. -    }
  79.      /* check if any GENERIC bits set */
  80. -    if (mask & 0xf000000) {
  81. -        if (mask & GENERIC_ALL) {
  82. +    if (win_mask & 0xf000000) {
  83. +        if (win_mask & GENERIC_ALL) {
  84.              if (file_type == NF4DIR)
  85.                  *nfs4_mask |= ACE4_ALL_DIR;
  86.              else
  87.                  *nfs4_mask |= ACE4_ALL_FILE;
  88.          } else {
  89. -            if (mask & GENERIC_READ)
  90. +            if (win_mask & GENERIC_READ)
  91.                  *nfs4_mask |= ACE4_GENERIC_READ;
  92. -            if (mask & GENERIC_WRITE)
  93. +            if (win_mask & GENERIC_WRITE)
  94.                  *nfs4_mask |= ACE4_GENERIC_WRITE;
  95. -            if (mask & GENERIC_EXECUTE)
  96. +            if (win_mask & GENERIC_EXECUTE)
  97.                  *nfs4_mask |= ACE4_GENERIC_EXECUTE;
  98.          }
  99.      }
  100. -    else /* ignoring generic and reserved bits */
  101. -        *nfs4_mask = mask & 0x00ffffff;
  102. -    if (DPRINTF_LEVEL_ENABLED(ACLLVL)) {
  103. -        print_nfs_access_mask(*nfs4_mask);
  104. +    else {
  105. +       /* Individual flags */
  106. +        if (file_type == NF4DIR) {
  107. +            if (win_mask & FILE_LIST_DIRECTORY) {
  108. +                *nfs4_mask |= ACE4_LIST_DIRECTORY;
  109.              }
  110. -    DPRINTF(ACLLVL,
  111. -        ("<-- map_winaccessmask2nfs4acemask(mask=0x%x, *nfs4_mask=0x%x)\n",
  112. -        (int)mask, (int)*nfs4_mask));
  113. +            if (win_mask & FILE_ADD_FILE) {
  114. +                *nfs4_mask |= ACE4_ADD_FILE;
  115. +            }
  116. +            if (win_mask & FILE_ADD_SUBDIRECTORY) {
  117. +                *nfs4_mask |= ACE4_ADD_SUBDIRECTORY;
  118. +            }
  119. +            if (win_mask & FILE_DELETE_CHILD) {
  120. +                *nfs4_mask |= ACE4_DELETE_CHILD;
  121. +            }
  122. +            if (win_mask & FILE_TRAVERSE) {
  123. +                *nfs4_mask |= ACE4_EXECUTE;
  124. +            }
  125. +        }
  126. +        else {
  127. +            if (win_mask & FILE_READ_DATA) {
  128. +                *nfs4_mask |= ACE4_READ_DATA;
  129. +            }
  130. +            if (win_mask & FILE_WRITE_DATA) {
  131. +                *nfs4_mask |= ACE4_WRITE_DATA;
  132. +            }
  133. +            if (win_mask & FILE_APPEND_DATA) {
  134. +                *nfs4_mask |= ACE4_APPEND_DATA;
  135. +            }
  136. +            if (win_mask & FILE_EXECUTE) {
  137. +                *nfs4_mask |= ACE4_EXECUTE;
  138. +            }
  139. +            /*
  140. +             * gisburn: Why does Win10 set |FILE_DELETE_CHILD| for
  141. +             * plain files ?
  142. +             */
  143. +            if (win_mask & FILE_DELETE_CHILD) {
  144. +                *nfs4_mask |= ACE4_DELETE_CHILD;
  145. +            }
  146. +        }
  147. +    }
  148. +
  149. +    if (win_mask & FILE_READ_EA) {
  150. +        *nfs4_mask |= ACE4_READ_NAMED_ATTRS;
  151. +    }
  152. +    if (win_mask & FILE_WRITE_EA) {
  153. +        *nfs4_mask |= ACE4_WRITE_NAMED_ATTRS;
  154. +    }
  155. +    if (win_mask & FILE_READ_ATTRIBUTES) {
  156. +        *nfs4_mask |= ACE4_READ_ATTRIBUTES;
  157. +    }
  158. +    if (win_mask & FILE_WRITE_ATTRIBUTES) {
  159. +        *nfs4_mask |= ACE4_WRITE_ATTRIBUTES;
  160. +    }
  161. +    if (win_mask & READ_CONTROL) {
  162. +        *nfs4_mask |= ACE4_READ_ACL;
  163. +    }
  164. +    if (win_mask & WRITE_DAC) {
  165. +        *nfs4_mask |= ACE4_WRITE_ACL;
  166. +    }
  167. +    if (win_mask & WRITE_OWNER) {
  168. +        *nfs4_mask |= ACE4_WRITE_OWNER;
  169. +    }
  170. +    if (win_mask & SYNCHRONIZE) {
  171. +        *nfs4_mask |= ACE4_SYNCHRONIZE;
  172. +    }
  173. +    if (win_mask & DELETE) {
  174. +        *nfs4_mask |= ACE4_DELETE;
  175. +    }
  176. +
  177. +#if 1
  178. +    /* Compare old and new code */
  179. +    if ((long)*nfs4_mask != (long)(win_mask & 0x00ffffff)) {
  180. +        DPRINTF(ACLLVL, ("#### map_winaccessmask2nfs4acemask: "
  181. +            "new code nfs4_mask=0x%lx, "
  182. +            "old code nfs4_mask=0x%lx\n",
  183. +            (long)*nfs4_mask, (long)(win_mask & 0x00ffffff)));
  184. +    }
  185. +#endif
  186. +}
  187. +
  188. +static
  189. +void map_nfs4acemask2winaccessmask(uint32_t nfs4_mask,
  190. +    int file_type, ACCESS_MASK *win_mask)
  191. +{
  192. +    bool is_generic = false;
  193. +
  194. +    /*
  195. +     * Generic masks
  196. +     * (|ACE4_GENERIC_*| contain multiple bits
  197. +     */
  198. +    if ((nfs4_mask & ACE4_GENERIC_READ) == ACE4_GENERIC_READ) {
  199. +        *win_mask |= GENERIC_READ;
  200. +        is_generic = true;
  201. +    }
  202. +    if ((nfs4_mask & ACE4_GENERIC_WRITE) == ACE4_GENERIC_WRITE) {
  203. +        *win_mask |= GENERIC_WRITE;
  204. +        is_generic = true;
  205. +    }
  206. +    if ((nfs4_mask & ACE4_GENERIC_EXECUTE) == ACE4_GENERIC_EXECUTE) {
  207. +        *win_mask |= GENERIC_EXECUTE;
  208. +        is_generic = true;
  209. +    }
  210. +    if (file_type == NF4DIR) {
  211. +        if ((nfs4_mask & ACE4_ALL_DIR) == ACE4_ALL_DIR) {
  212. +            *win_mask |= GENERIC_ALL;
  213. +            is_generic = true;
  214. +        }
  215. +    }
  216. +    else {
  217. +        if ((nfs4_mask & ACE4_ALL_FILE) == ACE4_ALL_FILE) {
  218. +            *win_mask |= GENERIC_ALL;
  219. +            is_generic = true;
  220. +        }
  221. +    }
  222. +#if 0
  223. +    if (is_generic)
  224. +        goto mapping_done;
  225. +#endif
  226. +    /* Individual flags */
  227. +    if (file_type == NF4DIR) {
  228. +        if (nfs4_mask & ACE4_LIST_DIRECTORY) {
  229. +            *win_mask |= FILE_LIST_DIRECTORY;
  230. +        }
  231. +        if (nfs4_mask & ACE4_ADD_FILE) {
  232. +            *win_mask |= FILE_ADD_FILE;
  233. +        }
  234. +        if (nfs4_mask & ACE4_ADD_SUBDIRECTORY) {
  235. +            *win_mask |= FILE_ADD_SUBDIRECTORY;
  236. +        }
  237. +        if (nfs4_mask & ACE4_DELETE_CHILD) {
  238. +            *win_mask |= FILE_DELETE_CHILD;
  239. +        }
  240. +        if (nfs4_mask & ACE4_EXECUTE) {
  241. +            *win_mask |= FILE_TRAVERSE;
  242. +        }
  243. +    }
  244. +    else {
  245. +        if (nfs4_mask & ACE4_READ_DATA) {
  246. +            *win_mask |= FILE_READ_DATA;
  247. +        }
  248. +        if (nfs4_mask & ACE4_WRITE_DATA) {
  249. +            *win_mask |= FILE_WRITE_DATA;
  250. +        }
  251. +        if (nfs4_mask & ACE4_APPEND_DATA) {
  252. +            *win_mask |= FILE_APPEND_DATA;
  253. +        }
  254. +        if (nfs4_mask & ACE4_EXECUTE) {
  255. +            *win_mask |= FILE_EXECUTE;
  256. +        }
  257. +    }
  258. +
  259. +    if (nfs4_mask & ACE4_READ_NAMED_ATTRS) {
  260. +        *win_mask |= FILE_READ_EA;
  261. +    }
  262. +    if (nfs4_mask & ACE4_WRITE_NAMED_ATTRS) {
  263. +        *win_mask |= FILE_WRITE_EA;
  264. +    }
  265. +    if (nfs4_mask & ACE4_READ_ATTRIBUTES) {
  266. +        *win_mask |= FILE_READ_ATTRIBUTES;
  267. +    }
  268. +    if (nfs4_mask & ACE4_WRITE_ATTRIBUTES) {
  269. +        *win_mask |= FILE_WRITE_ATTRIBUTES;
  270. +    }
  271. +    if (nfs4_mask & ACE4_READ_ACL) {
  272. +        *win_mask |= READ_CONTROL;
  273. +    }
  274. +    if (nfs4_mask & ACE4_WRITE_ACL) {
  275. +        *win_mask |= WRITE_DAC;
  276. +    }
  277. +    if (nfs4_mask & ACE4_WRITE_OWNER) {
  278. +        *win_mask |= WRITE_OWNER;
  279. +    }
  280. +    if (nfs4_mask & ACE4_SYNCHRONIZE) {
  281. +        *win_mask |= SYNCHRONIZE;
  282. +    }
  283. +    if (nfs4_mask & ACE4_DELETE) {
  284. +        *win_mask |= DELETE;
  285. +    }
  286. +#if 0
  287. +mapping_done:
  288. +    ;
  289. +#endif
  290.  }
  291.  
  292.  static int map_nfs4ace_who(PSID sid, PSID owner_sid, PSID group_sid, char *who_out, char *domain, SID_NAME_USE *sid_type_out)
  293. @@ -723,6 +909,7 @@ static int map_dacl_2_nfs4acl(PACL acl, PSID sid, PSID gsid, nfsacl41 *nfs4_acl,
  294.          PACE_HEADER ace;
  295.          PBYTE tmp_pointer;
  296.          SID_NAME_USE who_sid_type = 0;
  297. +        ACCESS_MASK win_mask;
  298.  
  299.          DPRINTF(ACLLVL, ("NON-NULL dacl with %d ACEs\n", acl->AceCount));
  300.          if (DPRINTF_LEVEL_ENABLED(ACLLVL)) {
  301. @@ -760,10 +947,6 @@ static int map_dacl_2_nfs4acl(PACL acl, PSID sid, PSID gsid, nfsacl41 *nfs4_acl,
  302.                  goto out_free;
  303.              }
  304.  
  305. -            map_winace2nfs4aceflags(ace->AceFlags, &nfs4_acl->aces[i].aceflag);
  306. -            map_winaccessmask2nfs4acemask(*(PACCESS_MASK)(ace + 1),
  307. -                file_type, &nfs4_acl->aces[i].acemask);
  308. -
  309.              tmp_pointer += sizeof(ACCESS_MASK) + sizeof(ACE_HEADER);
  310.  
  311.              status = map_nfs4ace_who(tmp_pointer, sid, gsid, nfs4_acl->aces[i].who,
  312. @@ -771,6 +954,27 @@ static int map_dacl_2_nfs4acl(PACL acl, PSID sid, PSID gsid, nfsacl41 *nfs4_acl,
  313.              if (status)
  314.                  goto out_free;
  315.  
  316. +            win_mask = *(PACCESS_MASK)(ace + 1);
  317. +
  318. +            map_winace2nfs4aceflags(ace->AceFlags,
  319. +                &nfs4_acl->aces[i].aceflag);
  320. +            map_winaccessmask2nfs4acemask(win_mask,
  321. +                file_type, &nfs4_acl->aces[i].acemask);
  322. +
  323. +            if (DPRINTF_LEVEL_ENABLED(ACLLVL)) {
  324. +                dprintf_out("win2nfs: nfs4_acl->aces[%d].who='%s', "
  325. +                    "acetype='%s', "
  326. +                    "win_mask=0x%lx, nfs_acemask=0x%lx\n",
  327. +                    i, nfs4_acl->aces[i].who,
  328. +                    (nfs4_acl->aces[i].acetype?
  329. +                        "DENIED ACE":"ALLOWED ACE"),
  330. +                    (long)win_mask, (long)nfs4_acl->aces[i].acemask);
  331. +                print_windows_access_mask(nfs4_acl->aces[i].who,
  332. +                    win_mask);
  333. +                print_nfs_access_mask(nfs4_acl->aces[i].who,
  334. +                    nfs4_acl->aces[i].acemask);
  335. +            }
  336. +
  337.              /*
  338.               * Treat |SidTypeAlias| as (local) group
  339.               *
  340. @@ -814,7 +1018,8 @@ static int handle_setacl(void *daemon_context, nfs41_upcall *upcall)
  341.      char ownerbuf[NFS4_OPAQUE_LIMIT+1];
  342.      char groupbuf[NFS4_OPAQUE_LIMIT+1];
  343.  
  344. -    DPRINTF(ACLLVL, ("--> handle_setacl()\n"));
  345. +    DPRINTF(ACLLVL, ("--> handle_setacl(state->path.path='%s')\n",
  346. +        state->path.path));
  347.  
  348.      if (args->query & OWNER_SECURITY_INFORMATION) {
  349.          DPRINTF(ACLLVL, ("handle_setacl: OWNER_SECURITY_INFORMATION\n"));
  350. diff --git a/daemon/daemon_debug.c b/daemon/daemon_debug.c
  351. index dcf2f4d..38f9856 100644
  352. --- a/daemon/daemon_debug.c
  353. +++ b/daemon/daemon_debug.c
  354. @@ -819,13 +819,13 @@ const char *map_nfs_ftype2str(int ftype)
  355.      return "<Unknown nfs_ftype4 type>";
  356.  }
  357.  
  358. -void print_windows_access_mask(ACCESS_MASK win_mask)
  359. +void print_windows_access_mask(const char *label, ACCESS_MASK win_mask)
  360.  {
  361. -    dprintf_out("--> print_windows_access_mask: 0x%lx\n", (long)win_mask);
  362. +    dprintf_out("--> print_windows_access_mask"
  363. +        "(label='%s',win_mask=0x%lx)\n", label, (long)win_mask);
  364.  #define PRINTWINACCESSMASKBITS(s) \
  365. -    if ((win_mask & (s)) == (s)) { \
  366. +    if (win_mask & (s)) { \
  367.          dprintf_out("\t" #s "\n"); \
  368. -        win_mask &= ~(s); \
  369.      }
  370.      PRINTWINACCESSMASKBITS(GENERIC_READ);
  371.      PRINTWINACCESSMASKBITS(GENERIC_WRITE);
  372. @@ -860,20 +860,16 @@ void print_windows_access_mask(ACCESS_MASK win_mask)
  373.      PRINTWINACCESSMASKBITS(FILE_GENERIC_WRITE);
  374.      PRINTWINACCESSMASKBITS(FILE_GENERIC_EXECUTE);
  375.  
  376. -    /* Print any "leftover" bits */
  377. -    if (win_mask) {
  378. -        dprintf_out("\t0x%lx\n", (long)win_mask);
  379. -    }
  380.      dprintf_out("<-- print_windows_access_mask\n");
  381.  }
  382.  
  383. -void print_nfs_access_mask(uint32_t nfs_mask)
  384. +void print_nfs_access_mask(const char *label, uint32_t nfs_mask)
  385.  {
  386. -    dprintf_out("--> print_nfs_access_mask: 0x%lx\n", (long)nfs_mask);
  387. +    dprintf_out("--> print_nfs_access_mask("
  388. +        "label='%s',nfs_mask=0x%lx)\n", label, (long)nfs_mask);
  389.  #define PRINTNFSMASKBITS(s) \
  390. -    if ((nfs_mask & (s)) == (s)) { \
  391. +    if (nfs_mask & (s)) { \
  392.          dprintf_out("\t" #s "\n"); \
  393. -        nfs_mask &= ~(s); \
  394.      }
  395.      PRINTNFSMASKBITS(ACE4_READ_DATA);
  396.      PRINTNFSMASKBITS(ACE4_LIST_DIRECTORY);
  397. @@ -899,10 +895,6 @@ void print_nfs_access_mask(uint32_t nfs_mask)
  398.      PRINTNFSMASKBITS(ACE4_GENERIC_EXECUTE);
  399.      PRINTNFSMASKBITS(ACE4_FILE_ALL_ACCESS);
  400.  
  401. -    /* Print any "leftover" bits */
  402. -    if (nfs_mask) {
  403. -        dprintf_out("\t0x%lx\n", (long)nfs_mask);
  404. -    }
  405.      dprintf_out("<-- print_nfs_access_mask\n");
  406.  }
  407.  
  408. diff --git a/daemon/daemon_debug.h b/daemon/daemon_debug.h
  409. index 78e5925..25a0924 100644
  410. --- a/daemon/daemon_debug.h
  411. +++ b/daemon/daemon_debug.h
  412. @@ -105,8 +105,8 @@ void eprintf_out(LPCSTR format, ...);
  413.  void eprintf(LPCSTR format, ...);
  414.  
  415.  const char *map_nfs_ftype2str(int ftype);
  416. -void print_windows_access_mask(ACCESS_MASK win_mask);
  417. -void print_nfs_access_mask(uint32_t nfs_mask);
  418. +void print_windows_access_mask(const char *label, ACCESS_MASK win_mask);
  419. +void print_nfs_access_mask(const char *label, uint32_t nfs_mask);
  420.  void print_hexbuf_no_asci(const char *title, const unsigned char *buf, int len);
  421.  void print_hexbuf(const char *title, const unsigned char *buf, int len);
  422.  void print_create_attributes(int level, DWORD create_opts);

Submit a correction or amendment below (click here to make a fresh posting)
After submitting an amendment, you'll be able to view the differences between the old and new posts easily.

Syntax highlighting:

To highlight particular lines, prefix each line with {%HIGHLIGHT}




All content is user-submitted.
The administrators of this site (kpaste.net) are not responsible for their content.
Abuse reports should be emailed to us at