firebird/firebird-mirror
firebird/firebird-mirror
8
0
Fork 1
mirror of https://github.com/FirebirdSQL/firebird.git synced 2025-01-23 04:43:03 +01:00
Code Issues

Better way for server to authenticate itself in security database.

Browse Source
This commit is contained in:
alexpeshkoff 2004-12-19 15:24:59 +00:00
parent 5398774153
commit 8a2e6d6c59
6 changed files with 37 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/dbs/security.sql
View File

@ -47,8 +47,7 @@ CREATE TABLE USERS_BG (USER_NAME USER_NAME,
COMMENT COMMENT,
FIRST_NAME NAME_PART,
MIDDLE_NAME NAME_PART,
LAST_NAME NAME_PART,
FULL_NAME COMPUTED BY (first_name || _UNICODE_FSS ' ' || middle_name || _UNICODE_FSS ' ' || last_name ));
LAST_NAME NAME_PART);
COMMIT;
@ -62,8 +61,7 @@ CREATE VIEW USERS (USER_NAME, SYS_USER_NAME, GROUP_NAME, UID, GID, PASSWD,
PRIVILEGE, COMMENT, FIRST_NAME, MIDDLE_NAME, LAST_NAME,
first_name || _UNICODE_FSS ' ' || middle_name || _UNICODE_FSS ' ' || last_name
FROM USERS_BG
WHERE CURRENT_USER = 'authenticator'
OR CURRENT_USER = 'SYSDBA'
WHERE CURRENT_USER = 'SYSDBA'
OR CURRENT_USER = USERS_BG.USER_NAME;
/* Access rights */

30
src/jrd/jrd.cpp
View File

@ -527,6 +527,22 @@ void JRD_thread_security_disable(bool disable)
}
bool JRD_get_thread_security_disabled()
{
/**************************************
*
* J R D _ g e t _ t h r e a d _ s e c u r i t y _ d i s a b l e d
*
**************************************
*
* Functional description
* Don't run internal handles thru the security gauntlet.
*
**************************************/
return TLS_GET(thread_security_disabled);
}
void JRD_print_pools(const char* filename) {
FILE *out = fopen(filename, "w");
ALL_print_memory_pool_info(out, databases);
@ -930,18 +946,13 @@ ISC_STATUS GDS_ATTACH_DATABASE(ISC_STATUS* user_status,
options.dpb_sql_dialect = 0;
// Don't run internal handles thru the security gauntlet.
const bool internal = TLS_GET(thread_security_disabled);
SCL_init(false,
options.dpb_sys_user_name.nullStr(),
options.dpb_user_name.nullStr(),
options.dpb_password.nullStr(),
options.dpb_password_enc.nullStr(),
options.dpb_role_name.nullStr(),
tdbb,
internal);
tdbb);
#if defined(V4_THREADING) && !defined(SUPERSERVER)
initing_security = false;
@ -1878,18 +1889,13 @@ ISC_STATUS GDS_CREATE_DATABASE(ISC_STATUS* user_status,
initing_security = true;
#endif
// Don't run internal handles thru the security gauntlet.
const bool internal = TLS_GET(thread_security_disabled);
SCL_init(true,
options.dpb_sys_user_name.nullStr(),
options.dpb_user_name.nullStr(),
options.dpb_password.nullStr(),
options.dpb_password_enc.nullStr(),
options.dpb_role_name.nullStr(),
tdbb,
internal);
tdbb);
#if defined(V4_THREADING) && !defined(SUPERSERVER)
initing_security = false;

1
src/jrd/jrd_proto.h
View File

@ -160,6 +160,7 @@ void JRD_unblock(Jrd::BlockingThread**);
void JRD_wlck_lock(struct mutx_t *);
void JRD_wlck_unlock(struct mutx_t *);
void JRD_thread_security_disable(bool disable);
bool JRD_get_thread_security_disabled();
// Call this function from the debugger if desired
void JRD_print_pools(const char* filename);

12
src/jrd/pwd.cpp
View File

@ -53,7 +53,7 @@ const bool SecurityDatabase::is_cached = false;
// BLR to search database for user name record
const UCHAR SecurityDatabase::PWD_REQUEST[256] = {
const UCHAR SecurityDatabase::PWD_REQUEST[] = {
blr_version5,
blr_begin,
blr_message, 1, 4, 0,
@ -67,7 +67,7 @@ const UCHAR SecurityDatabase::PWD_REQUEST[256] = {
blr_begin,
blr_for,
blr_rse, 1,
blr_relation, 5, 'U', 'S', 'E', 'R', 'S', 0,
blr_relation, 8, 'U', 'S', 'E', 'R', 'S', '_', 'B', 'G', 0,
blr_first,
blr_literal, blr_short, 0, 1, 0,
blr_boolean,
@ -275,7 +275,9 @@ bool SecurityDatabase::lookup_user(TEXT * user_name, int *uid, int *gid, TEXT *
{
if (lookup_db)
{
isc_detach_database(status, &lookup_db);
isc_db_handle tmp = lookup_db;
lookup_db = 0;
isc_detach_database(status, &tmp);
}
THREAD_ENTER();
ERR_post(isc_psw_attach, 0);
@ -362,11 +364,11 @@ bool SecurityDatabase::prepare()
dpb.getBufferLength(),
reinterpret_cast<const char*>(dpb.getBuffer()));
JRD_thread_security_disable(false);
isc_compile_request(status, &lookup_db, &lookup_req, sizeof(PWD_REQUEST),
reinterpret_cast<const char*>(PWD_REQUEST));
JRD_thread_security_disable(false);
if (status[1])
{
return false;

11
src/jrd/scl.epp
View File

@ -153,6 +153,12 @@ void SCL_check_access(const SecurityClass* s_class,
0);
}
// Don't run internal handles thru the security gauntlet.
if (JRD_get_thread_security_disabled())
{
return;
}
Attachment* attachment = tdbb->tdbb_attachment;
const SecurityClass* att_class = attachment->att_security_class;
@ -567,8 +573,7 @@ void SCL_init(bool create,
const TEXT* password,
const TEXT* password_enc,
const TEXT* sql_role,
thread_db* tdbb,
const bool internal)
thread_db* tdbb)
{
/**************************************
*
@ -622,7 +627,7 @@ void SCL_init(bool create,
ERR_post(isc_login, 0);
}
if (!internal)
if (!JRD_get_thread_security_disabled())
{
SecurityDatabase::verifyUser(name, user_name, password, password_enc,
&id, &group, &node_id);

2
src/jrd/scl_proto.h
View File

@ -41,7 +41,7 @@ void SCL_check_relation(const dsc*, Jrd::SecurityClass::flags_t);
Jrd::SecurityClass* SCL_get_class(const TEXT*);
Jrd::SecurityClass::flags_t SCL_get_mask(const TEXT*, const TEXT*);
void SCL_init(bool, const TEXT*, const TEXT*, const TEXT*, const TEXT*,
const TEXT*, Jrd::thread_db*, const bool);
const TEXT*, Jrd::thread_db*);
void SCL_move_priv(UCHAR**, Jrd::SecurityClass::flags_t, UCharBuffer&, ULONG*);
Jrd::SecurityClass* SCL_recompute_class(Jrd::thread_db*, const TEXT*);
void SCL_release(Jrd::SecurityClass*);