pastebin - collaborative debugging tool
nrubsig.kpaste.net RSS


msnfs41client backup 2024-04-25/001
Posted by Anonymous on Thu 25th Apr 2024 14:30
raw | new post

  1. diff --git a/cygwin/devel/msnfs41client.bash b/cygwin/devel/msnfs41client.bash
  2. index 1325d6f..7359f9d 100644
  3. --- a/cygwin/devel/msnfs41client.bash
  4. +++ b/cygwin/devel/msnfs41client.bash
  5. @@ -168,6 +168,10 @@ function nfsclient_rundeamon
  6.                 "$(uname -a)" \
  7.                 "$(is_windows_admin_account ; printf "%d\n" $((${?}?0:1)))"
  8.  
  9. +       # sync before starting nfs41 client daemon, to limit the damage
  10. +       # if the kernel module generates a crash on startup
  11. +       sync
  12. +
  13.         set -o xtrace
  14.  
  15.         typeset -a nfsd_args=(
  16. @@ -261,6 +265,10 @@ function nfsclient_system_rundeamon
  17.                 "$(uname -a)" \
  18.                 "$(is_windows_admin_account ; printf "%d\n" $((${?}?0:1)))"
  19.  
  20. +       # sync before starting nfs41 client daemon, to limit the damage
  21. +       # if the kernel module generates a crash on startup
  22. +       sync
  23. +
  24.         set -o xtrace
  25.  
  26.         typeset -a nfsd_args=(
  27. diff --git a/daemon/daemon_debug.c b/daemon/daemon_debug.c
  28. index 54fb411..8fb5150 100644
  29. --- a/daemon/daemon_debug.c
  30. +++ b/daemon/daemon_debug.c
  31. @@ -78,7 +78,46 @@ void dprintf_out(LPCSTR format, ...)
  32.  {
  33.      va_list args;
  34.      va_start(args, format);
  35. +#if 1
  36. +    char username[UNLEN+1];
  37. +    char groupname[GNLEN+1];
  38. +    HANDLE tok;
  39. +    const char *tok_src;
  40. +    bool free_tok = false;
  41. +
  42. +    if (OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, FALSE, &tok)) {
  43. +        tok_src = "impersonated_user";
  44. +        free_tok = true;
  45. +    }
  46. +    else {
  47. +        int lasterr = GetLastError();
  48. +        if (lasterr == ERROR_CANT_OPEN_ANONYMOUS) {
  49. +            tok_src = "anon_user";
  50. +        }
  51. +        else {
  52. +            tok_src = "proc_user";
  53. +        }
  54. +
  55. +        tok = GetCurrentProcessToken();
  56. +    }
  57. +
  58. +    if (!get_token_user_name(tok, username)) {
  59. +        (void)strcpy(username, "<unknown>");
  60. +    }
  61. +    if (!get_token_primarygroup_name(tok, groupname)) {
  62. +        (void)strcpy(groupname, "<unknown>");
  63. +    }
  64. +
  65. +    (void)fprintf(dlog_file, "%04x/%s['%s'/%s']: ",
  66. +        (int)GetCurrentThreadId(),
  67. +        tok_src, username, groupname);
  68. +
  69. +    if (free_tok) {
  70. +        (void)CloseHandle(tok);
  71. +    }
  72. +#else
  73.      (void)fprintf(dlog_file, "%04x: ", (int)GetCurrentThreadId());
  74. +#endif
  75.      (void)vfprintf(dlog_file, format, args);
  76.      (void)fflush(dlog_file);
  77.      va_end(args);
  78. diff --git a/daemon/mount.c b/daemon/mount.c
  79. index 7ab88be..560f7fa 100644
  80. --- a/daemon/mount.c
  81. +++ b/daemon/mount.c
  82. @@ -3,6 +3,7 @@
  83.   *
  84.   * Olga Kornievskaia <aglo@umich.edu>
  85.   * Casey Bodley <cbodley@umich.edu>
  86. + * Roland Mainz <roland.mainz@nrubsig.org>
  87.   *
  88.   * This library is free software; you can redistribute it and/or modify it
  89.   * under the terms of the GNU Lesser General Public License as published by
  90. @@ -71,6 +72,24 @@ static int handle_mount(void *daemon_context, nfs41_upcall *upcall)
  91.  
  92.      EASSERT(args->hostport != NULL);
  93.  
  94. +#define MOUNT_REJECT_REQUESTS_WITHOUT_IMPERSONATION_TOKEN 1
  95. +
  96. +#ifdef MOUNT_REJECT_REQUESTS_WITHOUT_IMPERSONATION_TOKEN
  97. +    logprintf("mount(hostport='%s', path='%s') request\n",
  98. +        args->hostport?args->hostport:"<NULL>",
  99. +        args->path?args->path:"<NULL>");
  100. +
  101. +    HANDLE tok;
  102. +    if (OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, FALSE, &tok)) {
  103. +        (void)CloseHandle(tok);
  104. +    }
  105. +    else {
  106. +        eprintf("handle_mount: Thread has no impersonation token\n");
  107. +        status = ERROR_NO_IMPERSONATION_TOKEN;
  108. +        goto out;
  109. +    }
  110. +#endif /* MOUNT_REJECT_REQUESTS_WITHOUT_IMPERSONATION_TOKEN */
  111. +
  112.      if ((args->path == NULL) || (strlen(args->path) == 0)) {
  113.          DPRINTF(1, ("handle_mount: empty mount root\n"));
  114.          status = ERROR_BAD_NETPATH;
  115. diff --git a/daemon/nfs41_daemon.c b/daemon/nfs41_daemon.c
  116. index 78393be..b4f59e3 100644
  117. --- a/daemon/nfs41_daemon.c
  118. +++ b/daemon/nfs41_daemon.c
  119. @@ -183,6 +183,10 @@ write_downcall:
  120.          upcall_marshall(&upcall, inbuf, (uint32_t)inbuf_len, (uint32_t*)&outbuf_len);
  121.  
  122.          DPRINTF(2, ("making a downcall: outbuf_len %ld\n\n", outbuf_len));
  123. +        /*
  124. +         * Note: Caller impersonation ends here - nfs41_driver.sys
  125. +         * |IOCTL_NFS41_WRITE| calls |SeStopImpersonatingClient()|
  126. +         */
  127.          status = DeviceIoControl(pipe, IOCTL_NFS41_WRITE,
  128.              inbuf, inbuf_len, NULL, 0, (LPDWORD)&outbuf_len, NULL);
  129.          if (!status) {
  130. diff --git a/daemon/nfs41_server.c b/daemon/nfs41_server.c
  131. index 23660dc..891869a 100644
  132. --- a/daemon/nfs41_server.c
  133. +++ b/daemon/nfs41_server.c
  134. @@ -3,6 +3,7 @@
  135.   *
  136.   * Olga Kornievskaia <aglo@umich.edu>
  137.   * Casey Bodley <cbodley@umich.edu>
  138. + * Roland Mainz <roland.mainz@nrubsig.org>
  139.   *
  140.   * This library is free software; you can redistribute it and/or modify it
  141.   * under the terms of the GNU Lesser General Public License as published by
  142. @@ -311,7 +312,36 @@ int nfs41_server_resolve(
  143.      hints.ai_flags    |= AI_FILESERVER;
  144.  #endif
  145.  
  146. +/*
  147. + * Windows bug: |GetAddrInfoExA()| ends impersonation
  148. + * Tested on CYGWIN_NT-10.0-19045 3.6.0-0.115.g579064bf4d40.x86
  149. + */
  150. +#define WINDOWS_GETADDRINFOEXA_STOPS_IMPERSONATION_BUG 1
  151. +
  152. +#ifdef WINDOWS_GETADDRINFOEXA_STOPS_IMPERSONATION_BUG
  153. +    HANDLE tok;
  154. +
  155. +    /*
  156. +     * Windows bug: |GetAddrInfoExA()| ends impersonation, so we copy
  157. +     * the current (impersonation) thread token, and later
  158. +     * set it after we are done with |GetAddrInfoExA()|
  159. +     */
  160. +    if (!OpenThreadToken(GetCurrentThread(),
  161. +        TOKEN_QUERY|TOKEN_IMPERSONATE, FALSE, &tok)) {
  162. +        tok = INVALID_HANDLE_VALUE;
  163. +        DPRINTF(0, ("nfs41_server_resolve: OpenThreadToken() failed, "
  164. +            "lasterr=%d.\n", (int)GetLastError()));
  165. +    }
  166. +#endif /* WINDOWS_GETADDRINFOEXA_STOPS_IMPERSONATION_BUG */
  167. +
  168.  retry_getaddrinfoex:
  169. +#ifdef WINDOWS_GETADDRINFOEXA_STOPS_IMPERSONATION_BUG
  170. +    if (!SetThreadToken(NULL, tok)) {
  171. +        DPRINTF(0, ("nfs41_server_resolve: SetThreadToken() failed, "
  172. +            "lasterr=%d\n", (int)GetLastError()));
  173. +    }
  174. +#endif /* WINDOWS_GETADDRINFOEXA_STOPS_IMPERSONATION_BUG */
  175. +
  176.      wse = GetAddrInfoExA(hostname, service, 0, NULL, &hints, &res,
  177.          NULL, NULL, NULL, NULL);
  178.      if (wse != 0) {
  179. @@ -330,6 +360,13 @@ retry_getaddrinfoex:
  180.          goto out;
  181.      }
  182.  
  183. +#ifdef WINDOWS_GETADDRINFOEXA_STOPS_IMPERSONATION_BUG
  184. +    if (!SetThreadToken(NULL, tok)) {
  185. +        DPRINTF(0, ("nfs41_server_resolve: SetThreadToken() failed, "
  186. +            "lasterr=%d\n", (int)GetLastError()));
  187. +    }
  188. +#endif /* WINDOWS_GETADDRINFOEXA_STOPS_IMPERSONATION_BUG */
  189. +
  190.      for (info = res; info != NULL; info = info->ai_next) {
  191.          DPRINTF(SRVLVL, ("GetAddrInfoExA() returned: info.{ai_family=%d}\n",
  192.              info->ai_family));
  193. @@ -398,5 +435,10 @@ out:
  194.          DPRINTF(SRVLVL, ("<-- nfs41_server_resolve('%s':%u) returning "
  195.              "OK { %s }\n", hostname, port, buff));
  196.      }
  197. +
  198. +#ifdef WINDOWS_GETADDRINFOEXA_STOPS_IMPERSONATION_BUG
  199. +    /* FIXME: We leak the token here */
  200. +#endif /* WINDOWS_GETADDRINFOEXA_STOPS_IMPERSONATION_BUG */
  201. +
  202.      return status;
  203.  }

Submit a correction or amendment below (click here to make a fresh posting)
After submitting an amendment, you'll be able to view the differences between the old and new posts easily.

Syntax highlighting:

To highlight particular lines, prefix each line with {%HIGHLIGHT}




All content is user-submitted.
The administrators of this site (kpaste.net) are not responsible for their content.
Abuse reports should be emailed to us at