From owner-p4-projects@FreeBSD.ORG Mon Mar 20 08:16:50 2006 Return-Path: X-Original-To: p4-projects@freebsd.org Delivered-To: p4-projects@freebsd.org Received: by hub.freebsd.org (Postfix, from userid 32767) id 0BEEB16A425; Mon, 20 Mar 2006 08:16:50 +0000 (UTC) X-Original-To: perforce@freebsd.org Delivered-To: perforce@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 86D9D16A42C for ; Mon, 20 Mar 2006 08:16:49 +0000 (UTC) (envelope-from soc-bushman@freebsd.org) Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115]) by mx1.FreeBSD.org (Postfix) with ESMTP id 472AB43D45 for ; Mon, 20 Mar 2006 08:16:49 +0000 (GMT) (envelope-from soc-bushman@freebsd.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.13.1/8.13.1) with ESMTP id k2K8Gm0Z078391 for ; Mon, 20 Mar 2006 08:16:49 GMT (envelope-from soc-bushman@freebsd.org) Received: (from perforce@localhost) by repoman.freebsd.org (8.13.1/8.13.1/Submit) id k2K8GmXn078388 for perforce@freebsd.org; Mon, 20 Mar 2006 08:16:48 GMT (envelope-from soc-bushman@freebsd.org) Date: Mon, 20 Mar 2006 08:16:48 GMT Message-Id: <200603200816.k2K8GmXn078388@repoman.freebsd.org> X-Authentication-Warning: repoman.freebsd.org: perforce set sender to soc-bushman@freebsd.org using -f From: soc-bushman To: Perforce Change Reviews Cc: Subject: PERFORCE change 93613 for review X-BeenThere: p4-projects@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: p4 projects tree changes List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Mar 2006 08:16:50 -0000 http://perforce.freebsd.org/chv.cgi?CH=93613 Change 93613 by soc-bushman@soc-bushman_stinger on 2006/03/20 08:16:31 eid checking is now embraced by the #ifdef macro - and is omitted by default - user need to define NS_CACHED_EID_CHECKING or NS_STRICT_CACHED_EID_CHECKING to make it work Affected files ... .. //depot/projects/soc2005/nsswitch_cached/src/usr.sbin/cached/mp_rs_query.c#3 edit .. //depot/projects/soc2005/nsswitch_cached/src/usr.sbin/cached/mp_ws_query.c#3 edit .. //depot/projects/soc2005/nsswitch_cached/src/usr.sbin/cached/query.c#3 edit Differences ... ==== //depot/projects/soc2005/nsswitch_cached/src/usr.sbin/cached/mp_rs_query.c#3 (text+ko) ==== @@ -197,10 +197,12 @@ dec_cache_entry_name = strdup( qstate->config_entry->mp_cache_params.entry_name); else { +#ifdef NS_CACHED_EID_CHECKING if (check_query_eids(qstate) != 0) { c_mp_rs_response->error_code = EPERM; goto fin; } +#endif asprintf(&dec_cache_entry_name, "%s%s", qstate->eid_str, qstate->config_entry->mp_cache_params.entry_name); ==== //depot/projects/soc2005/nsswitch_cached/src/usr.sbin/cached/mp_ws_query.c#3 (text+ko) ==== @@ -199,11 +199,14 @@ "entry '%s' performs lookups by itself: " "can't write to it", c_mp_ws_request->entry); goto fin; - } else + } else { +#ifdef NS_CACHED_EID_CHECKING if (check_query_eids(qstate) != 0) { c_mp_ws_response->error_code = EPERM; goto fin; } +#endif + } /* * All multipart entries are separated by their name decorations. ==== //depot/projects/soc2005/nsswitch_cached/src/usr.sbin/cached/query.c#3 (text+ko) ==== @@ -185,11 +185,12 @@ qstate->uid = cmsg.creds.cmcred_uid; qstate->gid = cmsg.creds.cmcred_gid; - + +#if defined(NS_CACHED_EID_CHECKING) || defined(NS_STRICT_CACHED_EID_CHECKING) /* * This check is probably a bit redundant - per-user cache is always separated * by the euid/egid pair -*/ + */ if (check_query_eids(qstate) != 0) { #ifdef NS_STRICT_CACHED_EID_CHECKING TRACE_OUT(on_query_startup); @@ -204,6 +205,7 @@ } #endif } +#endif switch (elem_type) { case CET_WRITE_REQUEST: @@ -503,11 +505,14 @@ "entry '%s' performs lookups by itself: " "can't write to it", write_request->entry); goto fin; - } else + } else { +#ifdef NS_CACHED_EID_CHECKING if (check_query_eids(qstate) != 0) { write_response->error_code = EPERM; goto fin; } +#endif + } configuration_lock_rdlock(s_configuration); c_entry = find_cache_entry(s_cache, @@ -694,12 +699,15 @@ */ if (qstate->config_entry->perform_actual_lookups != 0) memset(read_request->cache_key, 0, qstate->eid_str_length); - else + else { +#ifdef NS_CACHED_EID_CHECKING if (check_query_eids(qstate) != 0) { /* if the lookup is not self-performing, we check for clients euid/egid */ read_response->error_code = EPERM; goto fin; } +#endif + } configuration_lock_rdlock(s_configuration); c_entry = find_cache_entry(s_cache,