Chuck Lever [Fri, 16 Apr 2010 17:03:20 +0000 (13:03 -0400)]
libexport.a: export_find() should handle address parsing errors
An address mask parsing error can cause client_init(), and therefore
client_dup(), to make our process exit suddenly. Soon we want to add
more complex address parsing in client_init(), so we need this
interface to be a little more robust.
Since export_find() can return NULL in some cases, it can handle NULL
returns from its subroutines if an address parsing error occurs, or if
memory is exhausted. Allow for client_dup() to return NULL instead of
exiting sideways.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
Chuck Lever [Thu, 15 Apr 2010 12:59:18 +0000 (08:59 -0400)]
libexport.a: Add helper for populating m_addrlist[]
Clean up: Move common code that populates an nfs_client record's
m_addrlist to a helper function. This eliminates a little code
duplication, and makes it simpler to add IPv6 support later.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
Chuck Lever [Thu, 15 Apr 2010 12:57:29 +0000 (08:57 -0400)]
libexport.a: Reduce code duplication in client_init()
Clean up: Most cases in client_init() set clp->m_naddr to zero. Move
it to the common part of the function, and simplify the logic. This
will make adding IPv6 support here more straightforward.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
Chuck Lever [Thu, 8 Apr 2010 14:54:01 +0000 (10:54 -0400)]
libexport.a: Refactor netgroup checking in client_check()
Clean up: refactor netgroup logic out of client_check() to make it
easier to introduce IPv6 support.
+ Use preferred style of keeping #ifdef out of the middle of
function definitions. Squelch compiler warnings for "#ifndef
HAVE_INNETGR" by using __attribute__((unused)).
+ Use preferred style of not using curly braces around switch cases.
+ Match style used for check_{fqdn,subnetwork}.
+ Clarify comment documenting use of h_aliases
Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
Chuck Lever [Thu, 8 Apr 2010 14:51:54 +0000 (10:51 -0400)]
libexport.a: Factor SUBNETWORK checking out of check_client()
Clean up: Factor the MCL_SUBNETWORK case out of check_client() and
client_checkaddr(). This will make it easier to add IPv6 support
eventually.
The logic in the new helper function will get a little more tangled
once IPv6 support is introduced. Each slot in the clp address list
eventually may contain an address from either address family.
Note that the switch statement in client_checkaddr() is redundant,
since clp->cl_mtype is loop invariant. This change makes SUBNETWORK
client checking more computationally efficient, at the cost of a few
extra lines of code.
This commit should not change code behavior in any way.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
Chuck Lever [Thu, 8 Apr 2010 14:50:41 +0000 (10:50 -0400)]
libexport.a: Factor FQDN checking out of check_client()
Clean up: Factor the MCL_FQDN case out of check_client() and
client_checkaddr(). This will make it easier to add IPv6 support
eventually.
The logic in the new helper function will get a little more tangled
once IPv6 support is introduced. Each slot in the clp address list
eventually may contain an address from either address family.
Note that the switch statement in client_checkaddr() is redundant,
since clp->cl_mtype is loop invariant. This change makes FQDN client
checking more computationally efficient, at the cost of a few extra
lines of code.
This commit should not change code behavior in any way.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
Chuck Lever [Fri, 19 Mar 2010 20:14:26 +0000 (16:14 -0400)]
mount: Mount should retry unreachable hosts
Currently if a server is up but not responding (ie, it answers ARP
requests, but not NFS or RPC requests), mount retries or backgrounds
itself waiting for the server.
If the server is not responding on the network at all, mount fails
the mount request immediately.
Users might find it more useful if mount retried in both cases.
Note that this change means attempting to mount using a misspelled
server name will "hang" for the retry amount. I suppose the error
message isn't very helpful whether it fails immediately or waits
a couple of minutes, though I imagine that an unreachable server is a
much more common occurrence than a misspelling.
Reported-by: Daniel Goering <g_daniel@gmx.net> Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
Chuck Lever [Fri, 19 Mar 2010 20:03:45 +0000 (16:03 -0400)]
sm-notify: Send fully-qualified and unqualified mon_names
During any file locking interaction between an NFS client and server,
the client tells the server what hostname it will use as the mon_name
argument of the SM_NOTIFY request sent by the client when it reboots.
This is the "caller_name" argument of an NLMPROC_LOCK request.
The server, however, never tells the client what mon_name argument
it will use when sending an SM_NOTIFY request. In order to recognize
the server, clients usually guess what mon_name the server might
send, by using the server hostname provided by the user on the mount
command line.
Frequently, the user provides an unqualified server name on the mount
command. The server might then call the client back with a fully
qualified domain name, which might not match in some cases.
Solaris, and perhaps other implementations, attempt to mitigate this
problem by sending two SM_NOTIFY requests to each peer: one with an
unqualified mon_name argument, and one with a fully qualified mon_name.
Implement such a scheme for sm-notify.
Since my_name is almost always the fully-qualified hostname associated
with the local system, just wiping the left-most '.' in the my_name
argument and sending another SM_NOTIFY is nearly always sufficient.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
Chuck Lever [Wed, 17 Mar 2010 10:15:08 +0000 (06:15 -0400)]
sm-notify: Use my_name when sending SM_NOTIFY requests
The mon_name argument of an SM_NOTIFY request is a string that
identifies the rebooting host.
sm-notify should send the my_name provided by the local lockd at the
time the remote was monitored, rather than cocking up a mon_name
argument based on the present return value of gethostname(3). If the
local system's hostname happened to change after the last reboot, then
the string returned by gethostname(3) will not be recognized by the
remote. Thus the remote will never initiate lock recovery for the
original named host, possibly leaving stale locks.
The existing behavior of using the -v command line option as the
mon_name argument is preserved, but we now prevent sending an IP
presentation address, as some non-Linux implementations don't
recognize addresses as valid mon_names.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Reviewed-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
Steve Dickson [Mon, 8 Mar 2010 16:22:46 +0000 (11:22 -0500)]
mountd: fix --manage-gids hang due to int/uint bug
A uid or gid should be represented as unsigned, not signed.
The conversion to signed here could cause a hang on access by an unknown
user to a server running mountd with --manage-gids; such a user is
likely to be mapped to 232-1, which may be converted to 231-1 when
represented as an int, resulting in a downcall for uid 231-1, hence the
original rpc hanging forever waiting for a cache downcall for 232-1.
Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
Steve Dickson [Mon, 8 Mar 2010 15:24:44 +0000 (10:24 -0500)]
Use authunix_create() instead of authsys_create() to fix regression.
Commit 409b8 introduced a regression when the --disable-tirpc
configuration flag is set. The authsys_create() interface, which
was introduced, does not exist in the legacy glibc library.
Since the authsys_create() interface is a redefined of the
authunix_create() interface, which is defined in glibc, using
authunix_create() resolves the regression,
Acked-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
Jeff Layton [Mon, 1 Mar 2010 13:07:34 +0000 (08:07 -0500)]
nfs-utils: add and use nfs_authsys_create
The current mount, umount and showmount code uses
authunix_create_default to get an auth handle. The one provided by glibc
returned a truncated list of groups when there were more than 16 groups.
libtirpc however currently does an abort() in this case, which causes
the program to crash and dump core.
nfs-utils just uses these auth handles for the MNT protocol, so the
group list doesn't make a lot of difference here. Add a new function
that creates an auth handle with a supplemental gids list that consists
only of the primary gid. Have nfs-utils use that function anywhere that
it currently uses authunix_create_default. Also, have the caller
properly check for a NULL return from that function.
Signed-off-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
Chuck Lever [Thu, 18 Feb 2010 11:41:11 +0000 (06:41 -0500)]
mount: Set protocol family properly for "udp" and "tcp"
In nfs_nfs_proto_family(), *family is never set if the legacy
"udp" or "tcp" mount options are specified. The result is an error
message at umount time, for example:
umount.nfs: DNS resolution failed for
2001:5c0:1101:2f00:250:8dff:fe95:5c61: ai_family not supported
even if mount was built with IPv6 support.
The man page says that "udp" is a synonym for "proto=udp", and
likewise for "tcp". Thus, we don't look at config_default_family
here, but always use AF_INET explicitly, to be consistent with the
meaning of proto=.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Reviewed-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
Steve Dickson [Wed, 17 Feb 2010 19:38:19 +0000 (14:38 -0500)]
nfsd: Disble NFS 4.1 functionality by default
Due to the fact the current kernel code do not completely
conform to the NFS 4.1 RFC, this patch disable the 4.1 support
on the server.
To control this 41 functionality, the NFS41_SUPPORTED
configuration variable now exist that will allow us to
re enable the functionality without any code changes.
Jeff Layton [Fri, 12 Feb 2010 19:33:34 +0000 (14:33 -0500)]
mount.nfs: return error if proto= option specified IPv6 when IPv6 isn't supported
Right now, there's nothing that expressly forbids someone from
specifying proto=tcp6 for instance, even when nfs-utils it built without
IPv6 support. This may not work well if (for instance) they are using
NFSv3, since statd won't support IPv6. Explicitly return an error if
someone specifies an IPv6 proto= or mountproto= option and IPv6 isn't
supported.
Signed-off-by: Jeff Layton <jlayton@redhat.com> Reviewed-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
Chuck Lever [Fri, 12 Feb 2010 19:26:46 +0000 (14:26 -0500)]
statd: Remove SIMU_CRASH warning
SM_SIMU_CRASH isn't used, so this warning is never seen today.
However, if we ever wanted to use SM_SIMU_CRASH, this warning
is unnecessarily alarming, and serves no real purpose.
At some point in the near future I'd like us to consider using
SM_SIMU_CRASH, so let's get rid of this message now.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
Jeff Layton [Fri, 12 Feb 2010 19:23:16 +0000 (14:23 -0500)]
This is the second iteration of this patch. The only difference here
is that this one has default_value call nfs_nfs_proto_family regardless
of whether IPV6_SUPPORTED is set.
When IPv6 is enabled, the Proto= config file option is treated as a
netid, and the address family for lookups is selected based on that
setting. The Defaultproto= option however still only affects the
protocol setting for the sockets (IPPROTO_*) and not the address family.
This patch makes it so that if someone sets the "Defaultproto=" option
in the nfsmount.conf, it's used to determine the default address family
for lookups as well as the protocol type.
This gives users a way to force a particular address family to be used
universally for mounts and brings the behavior of the Defaultproto=
option in line with the Proto= option.
Signed-off-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
Chuck Lever [Fri, 12 Feb 2010 18:38:59 +0000 (13:38 -0500)]
text-based mount: Support protocol family negotiation
Jeff Layton pointed out that the current negotiation logic in
stropts.c simply doesn't handle the case where a server may have an
IPv6 address and an IPv4 address, but only NFS/IPv4 is supported.
This is typical of all currently deployed Linux servers.
Add support for trying all addresses returned from DNS when
"proto=" is not specified on the command line.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
Chuck Lever [Fri, 12 Feb 2010 18:36:17 +0000 (13:36 -0500)]
text-based mount: Set addr= option in nfs_try_mount_foo()
When retrying a mount request with a different server address, the
addr= option may change each time through the fg/bg loop.
Instead of setting the addr= option in nfs_validate_options(), set it
in nfs_try_mount_v2v3() and nfs_try_mount_v4(). This is much the
same thing we did recently with the version-specific mount options
which might change each time through the fg/bg retry loop.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
Chuck Lever [Fri, 12 Feb 2010 18:10:03 +0000 (13:10 -0500)]
text-based mount: Replace nfs_lookup() with getaddrinfo(3)
Originally I thought it would be best to share the DNS query code
between the legacy mount code and the new text-based code, hence
the introduction of nfs_lookup(). However, it now appears we want
the text-based code to do a little more than take the first address
returned by the query.
So, let's invoke getaddrinfo(3) directly in stropts.c, and save
the returned addrinfo struct until the end of processing.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
Chuck Lever [Fri, 12 Feb 2010 18:04:14 +0000 (13:04 -0500)]
text-based mount: Retry when server can't be reached
We want new default behavior from mount.nfs when the server refuses a
connection. Since connection refusal can be spurious (for example,
if the server is rebooting), mount.nfs should retry.
NFS shares that are automatically mounted by /etc/fstab at boot
time may be problematic. The new behavior can be disabled by
specifying the "retry=0" mount option, or these mounts can be changed
to background mounts by specifying the "bg" option.
A kernel code change is still required for the mount(2) system call to
return ECONNREFUSED for NFSv4 mounts (see 2.6.33). For v2/v3, the
version and transport negotiation logic in mount.nfs should drive a
retry if the server's rpcbind can't be reached.
Note that if a v2/v3 mount request encounters an unregistered NFS
service, it will still fail immediately. That wouldn't be too hard
to change as well, but there are many more corner cases there where
failing immediately is appropriate.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
J. Bruce Fields [Thu, 4 Feb 2010 22:03:53 +0000 (17:03 -0500)]
nfsd: fix version-setting regression on old kernels
/proc/fs/nfsd/versions was extended to allow turning on/off minor
versions by echoing "+4.1" or "-4.1" to /proc/fs/nsfd/versions.
Unfortunately, pre-2.6.30 kernels just stop parsing at first non-digit,
so "-4.1" is interpreted as "-4". If new nfs-utils (on old kernel)
writes "+2", "+3", "+4", then "-4.1", result therefore is to turn off
4.1.
Given that historical behavior, it may have been a mistake to extend the
interface the way we did; but at this point we're probably stuck with
it. So, just reverse the order we write versions in.
Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
When the protocol version is set on the command line,
none of the variables set in the configuration file
are passed down to the kernel due to a bug in the
parsing routine.
Tested-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
Clean up: the use of identifiers called "access" and "daemon" shadow
function declarations in unistd.h. Seen with "-Wextra -pedantic".
tcpwrapper.c: In function haccess_add:
tcpwrapper.c:112: warning: declaration of access shadows a global
declaration /usr/include/unistd.h:288: warning: shadowed declaration is here
tcpwrapper.c: In function good_client:
tcpwrapper.c:161: warning: declaration of daemon shadows a global declaration
/usr/include/unistd.h:953: warning: shadowed declaration is here
tcpwrapper.c: In function check_default:
tcpwrapper.c:212: warning: declaration of daemon shadows a
global declaration
/usr/include/unistd.h:953: warning: shadowed declaration is here
good_client() is used only in support/misc/tcpwrapper.c, so make it
static (and update its prototype to c99 standard form).
Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
Chuck Lever [Sun, 17 Jan 2010 21:50:29 +0000 (16:50 -0500)]
tcpwrapper: Fix signage problems in the tcp_wrappers hash function
Eliminate the following compiler warnings:
tcpwrapper.c:78: warning: no previous prototype for strtoint
tcpwrapper.c: In function strtoint
tcpwrapper.c:81: warning: conversion to int size_t may change the
sign of the result
tcpwrapper.c:85: warning: conversion to unsigned int from int may
change the sign of the result
tcpwrapper.c: In function hashint:
tcpwrapper.c:91: warning: conversion to int from unsigned int may
change the sign of the result
The hash value is probably computed consistently even with
unexpected sign inversions.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
Chuck Lever [Sun, 17 Jan 2010 21:48:56 +0000 (16:48 -0500)]
tcp_wrapper: Clean up logit()
Eliminate these compiler warnings:
tcpwrapper.c: In function logit
tcpwrapper.c:225: warning: unused parameter procnum
tcpwrapper.c:225: warning: unused parameter prognum
Actually, @procnum is not used anywhere in our tcpwrapper.c, so
let's just get rid of it.
Since there is only one logit() call site in tcpwrapper.c, the macro
wrapper just adds needless clutter. Let's get rid of that too.
Finally, both mountd and statd now use xlog(), which adds an
appropriate program name prefix to every message. Replace the
open-coded syslog(2) call with an xlog() call in order to
consistently identify the RPC service reporting the intrusion.
Since logit() no longer references "deny_severity" and no nfs-utils
caller sets either allow_severity or deny_severity, we remove them.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
Chuck Lever [Fri, 15 Jan 2010 20:53:07 +0000 (15:53 -0500)]
tcp_wrappers: Use getifaddrs(3) if it is available
After glibc 2.3.3, getifaddrs(3) can return AF_INET6 addresses for
local network interfaces. Using the library call is easier than
trying to update the open code in from_local(), and means we have
less to maintain in nfs-utils going forward.
And, since from_local() can now support IPv6, change its synopsis to
take a "struct sockaddr *" .
Note that the original code discovers local addresses once. These
days, with wifi, DHCP, and NetworkManager, the local network
configuration can change dynamically over time. So, call getifaddrs()
more often to ensure from_local() has up-to-date network configuration
information.
This implementation refreshes the list if from_local() has not been
called in the last second. This is actually not terribly honerous.
check_default() invokes from_local() only when the remote host is not
in its access cache, or the access/deny files have changed.
So new hosts will cause a refresh, but previously seen hosts
(including localhost) should not.
On the other hand, it still may not be often enough. After the first
call, if only previously seen hosts attempt to access our daemons,
from_local() would never be called, and the local list would never be
updated. This might be possible during steady-state operation with
a small number of servers and clients.
It would also be nice if we could free the local interface address
list at shutdown time, but that would be a lot of trouble for little
gain.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Chuck Lever [Fri, 15 Jan 2010 20:14:38 +0000 (15:14 -0500)]
tcpwrappers: Use xlog() instead of perror(3) and syslog(2)
Clean up: Replace calls to syslog(2) and perror(3) in from_local.c
with calls to xlog(). The problems displayed by the perror(3) calls
especially should be reported. Currently they are never seen in the
system log.
As part of a build test, I defined TEST, and found a couple of
problems with main(), which are also addressed in this patch.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Chuck Lever [Thu, 14 Jan 2010 17:24:39 +0000 (12:24 -0500)]
statd: Support TI-RPC statd listener
If TI-RPC is available, use it to create statd's svc listener. If
not, use the old function, rpc_init(), to create statd's listener.
IPv6 can be supported if TI-RPC is available. In this case,
/etc/netconfig is searched to determine which transports to advertise.
Add the new listener creation API in libnfs.a since other components
of nfs-utils (such as rpc.mountd) will eventually want to share it.
A little re-arrangement of when the statd listener is created is done
to make unregistration of the statd service more reliable. As it is
now, the statd service is never unregistered when it exits. After it
is gone, other programs usually hang when trying to access statd or
see if it's running, since the registration is still there but statd
itself does not respond.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Chuck Lever [Thu, 14 Jan 2010 17:24:34 +0000 (12:24 -0500)]
libnsm.a: retain CAP_NET_BIND when dropping privileges
I'm about to switch the order of listener creation and dropping root
privileges. rpc.statd will drop privileges first, then create its
listeners. The reason for the new ordering is explained in a
subsequent patch.
However, for non-TI-RPC builds, rpc_init() needs to use a privileged
port to do pmap registrations. For both TI-RPC and non-TI-RPC builds,
CAP_NET_BIND is required in case the admin requests a privileged
listener port on the statd command line.
So that these requirements are met, nsm_drop_privileges() will now
retain CAP_NET_BIND while dropping root.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Chuck Lever [Thu, 14 Jan 2010 17:24:30 +0000 (12:24 -0500)]
statd: Remove NL_ADDR() macro
Clean up: The contents of NL_ADDR are fixed: they are always the IPv4
loopback address. Some time ago, the use of NL_ADDR() was stubbed out
of the NLM downcall forward path, replaced with a constant IPv4
loopback address.
Stub it out of the reply path as well, and then remove NL_ADDR
entirely.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Chuck Lever [Thu, 14 Jan 2010 17:24:23 +0000 (12:24 -0500)]
statd: Support IPv6 in sm_stat_1_svc()
SM_STAT is usually not used by most contemporary NSM implementations,
but for consistency, it gets the same treatment as sm_mon_1_svc(),
since both should use the same logic to determine whether a mon_name
is able to be monitored.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Chuck Lever [Thu, 14 Jan 2010 17:24:08 +0000 (12:24 -0500)]
statd: Add API to canonicalize mon_names
Provide a shared function to generate canonical names that statd
uses to index its on-disk monitor list. This function can resolve
DNS hostnames, and IPv4 and IPv6 presentation addresses.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Chuck Lever [Thu, 14 Jan 2010 17:24:00 +0000 (12:24 -0500)]
libnsm.a: Add support for multiple lines in monitor record files
To support IPv6, statd must support multi-homed remote peers. For our
purposes, "multi-homed peer" means that more than one unique IP
address maps to the one canonical host name for that peer.
An SM_MON request from the local lockd has a "mon_name" argument that
statd reverse maps to a canonical hostname (ie the A record for that
host). statd assumes the canonical hostname is unique enough that
it stores the callback data for this mon_name in a file named after
that canonical hostname.
Because lockd can't distinguish between two unique IP addresses that
may be from the same physical host, the kernel can hand statd a
mon_name that maps to the same canonical hostname as some previous
mon_name. So that the kernel can keep this instance of the mon_name
unique, it creates a fresh priv cookie for each new address.
Note that a mon_name can be a presentation address string, or the
caller_name string sent in each NLMPROC_LOCK request. There's
nothing that requires the caller_name to be a fully-qualified
hostname, thus it's uniqueness is not guaranteed. The current
design of statd assumes that canonical hostnames will be unique
enough.
When a mon_name for a fresh SM_MON request maps to the same canonical
hostname as an existing monitored peer, but the priv cookie is new,
statd will try to write the information for the fresh request into an
existing monitor record file, wiping out the contents of the file.
This is because the mon_name/cookie combination won't match any record
statd already has.
Currently, statd doesn't check if a record file already exists before
writing into it. statd's logic assumes that the svc routine has
already checked that no matching record exists in the in-core monitor
list. And, it doesn't use O_EXCL when opening the record file. Not
only is the old data in that file wiped out, but statd's in-core
monitor list will no longer match what's in the on-disk monitor list.
Note that IPv6 isn't needed to exercise multi-homed peer support.
Any IPv4 peer that has multiple addresses that map to its canonical
hostname will trigger this behavior. However, this scenario will
become quite common when all hosts on a network automatically get both
an IPv4 address and an IPv6 address.
I can think of a few ways to address this:
1. Replace the current on-disk format with a database that has a
uniqueness constraint on the monitor records
2. Create a new file naming scheme; eg. one that uses a truly
unique name such as a hash generated from the mon_name, my_name, and
priv cookie
3. Support multiple lines in each monitor record file
Since statd's on-disk format constitutes a formal API, options 1 and 2
are right out. This patch implements option 3. There are two parts:
adding a new line to an existing file; and deleting a line from a file
with more than one line. Interestingly, the existing code already
supports reading more than one line from these files, so we don't need
to add extra code here to do that.
One file may contain a line for every unique mon_name / priv cookie
where the mon_name reverse maps to the same canonical hostname. We
use the atomic write facility added by a previous patch to ensure the
on-disk monitor record list is updated atomically.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Chuck Lever [Thu, 14 Jan 2010 17:23:53 +0000 (12:23 -0500)]
libnsm.a: Factor atomic write code out of nsm_get_state()
We're about to use the same logic (mktemp, write, rename) for
other new purposes, so pull it out into its own function.
This change also addresses a latent bug: O_TRUNC is now used when
creating the temporary file. This eliminates the possibility of
getting stale data in the temp file, if somehow a previous "atomic
write" was interrupted and didn't remove the temporary file.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Chuck Lever [Thu, 14 Jan 2010 17:23:48 +0000 (12:23 -0500)]
sm-notify: Save mon_name and my_name strings
Currently sm-notify does not use the mon_name and my_name strings
passed to smn_get_host(). Very soon we're going to need the mon_name
and my_name strings, so add code to store those strings in struct
nsm_host, and free them when each host is forgotten.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Chuck Lever [Thu, 14 Jan 2010 17:23:37 +0000 (12:23 -0500)]
statd: Support IPv6 is caller_is_localhost()
For the time being, statd is not going to support receiving SM_MON
calls from the local lockd via IPv6.
However, the upcalls (SM_MON, etc.) from the local lockd arrive on the
same socket that receives calls from remote peers. Thus
caller_is_localhost() at least has to be smart enough to notice that
the caller is not AF_INET, and to display non-AF_INET addresses
appropriately.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Chuck Lever [Thu, 14 Jan 2010 17:23:23 +0000 (12:23 -0500)]
statd: add nsm_present_address() API
Add an API to convert a socket address to a presentation address
string. This is used for displaying error messages and the like.
We prefer getnameinfo(3) over inet_?to?(3) as it supports IPv6 scope
IDs. Since statd has to continue to build correctly on systems whose
glibc does not have getnameinfo(3), an inet_?to?(3) version is also
provided.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Chuck Lever [Thu, 14 Jan 2010 17:23:19 +0000 (12:23 -0500)]
statd: Introduce statd version of matchhostname()
For the near future, statd will support IPv6 but exportfs will not.
Thus statd will need a version of matchhostname() that can deal
properly with IPv6 remotes. To reduce the risk of breaking exportfs,
introduce a separate version of matchhostname() for statd to use while
exportfs continues to use the existing AF_INET-only implementation.
Note that statd will never send matchhostname() a hostname string
containing export wildcards, so is_hostame() is not needed in the
statd version of matchhostname(). This saves some computational
expense when comparing hostnames.
A separate statd-specific implementation of matchhostname() allows
some flexibility in the long term, as well. We might want to enrich
the matching heuristics of our SM_NOTIFY, for example, or replace
them entirely with a heuristic that is not dependent upon DNS.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Chuck Lever [Thu, 14 Jan 2010 17:22:59 +0000 (12:22 -0500)]
sm-notify: Use getaddrinfo(3) to create bind address in smn_create_socket()
This patch updates the "bind to a user-specified port" arm of
smn_create_socket() so it can deal with IPv6 bind addresses.
A single getaddrinfo(3) call can convert a user-specified bind address
or hostname to a socket address, optionally plant a provided port
number, or whip up an appropriate wildcard address for use as the main
socket's bind address.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Chuck Lever [Thu, 14 Jan 2010 17:22:33 +0000 (12:22 -0500)]
sm-notify: Support creating a PF_INET6 socket in smn_create_socket()
Socket creation is unfortunately complicated by the need to handle the
case where sm-notify is built with IPv6 support, but the local system
has disabled it entirely at run-time (ie, socket(3) returns
EAFNOSUPPORT when we try to create an AF_INET6 socket).
The run-time address family setting is made available in the global
variable nsm_family. This setting can control the family of the
socket's bind address and what kind of addresses we want returned by
smn_lookup(). Support for that is added in subsequent patches.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Chuck Lever [Thu, 14 Jan 2010 17:22:26 +0000 (12:22 -0500)]
sm-notify: factor socket creation out of notify()
The top half of the notify() function creates the main socket that
sm-notify uses to do its job. To make adding IPv6 support simpler,
refactor that piece into a separate function.
The logic is modified slightly so that exit(3) is invoked only in
main(). This is not required, but it makes the code slightly easier
to understand and maintain.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Chuck Lever [Thu, 14 Jan 2010 17:22:12 +0000 (12:22 -0500)]
statd: Update rmtcall.c
Replace the open code to construct NLM downcalls and PMAP_GETPORT RPC
requests with calls to our new library routines.
This clean up removes redundant code in rmtcall.c, and enables the
possibility of making NLM downcalls via IPv6 transports. We won't
support that for a long while, however.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Chuck Lever [Thu, 14 Jan 2010 17:22:09 +0000 (12:22 -0500)]
sm-notify: Replace RPC code
Replace the open code to construct SM_NOTIFY and PMAP_GETPORT RPC
requests with calls to our new library routines that support
IPv6 and RPCB_GETADDR as well.
This change allows sm-notify to send RPCB_GETADDR, but it won't do
that until the main sm-notify socket supports PF_INET6 and the DNS
resolution logic is updated to return IPv6 addresses.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Chuck Lever [Tue, 12 Jan 2010 21:41:43 +0000 (16:41 -0500)]
libnsm.a: Add RPC construction helper functions
To manage concurrency, both statd and sm-notify construct raw RPC
requests in socket buffers, and use a minimal request scheduler
to send these requests and manage replies. Both statd and sm-notify
open code the RPC request construction.
Introduce helper functions that can construct and send raw
NSMPROC_NOTIFY, NLM downcalls, and portmapper calls over a datagram
socket, and receive and parse their replies. Support for IPv6 and
RPCB_GETADDR is featured. This code (and the IPv6 support it
introduces) can now be shared by statd and sm-notify, eliminating
code and bug duplication.
This implementation is based on what's in utils/statd/rmtcall.c now,
but is wrapped up in a nice API and includes extra error checking.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Only NFSv4 clients will actually want to see referall points--others are
better off just seeing an empty directory, that they can manually (or
with automount) mount the appropriate filesystem on.
So we want the kernel to automatically traverse only in the v4 case (as
recent kernels do).
Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
J. Bruce Fields [Wed, 13 Jan 2010 00:27:21 +0000 (19:27 -0500)]
mountd: better hiding of v4root exports from mountd clients
We've hidden v4root exports from get_exportlist (hence from the
showmount command), but not from other mountd operations--allowing
clients to attempt to mount exports when they should be getting an
immediate error.
Symptoms observed on a linux client were that a mount that previously
would have returned an error immediately now hung. This restores the
previous behavior.
Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
J. Bruce Fields [Sat, 9 Jan 2010 17:44:57 +0000 (10:44 -0700)]
mountd: minor v4root_set cleanup, check strdup return
Move more of v4root_set into a helper function.
Also, check the return value from strdup. (We don't really handle the
error well yet--we'll end up giving negative replies to export upcalls
when we should be giving the kernel exports, resulting in spurious
-ENOENTs or -ESTALE's--but that's better than crashing with a NULL
dereference.)
Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
J. Bruce Fields [Sat, 9 Jan 2010 17:22:17 +0000 (10:22 -0700)]
mountd: minor optimization in v4root_set
Since we're adding new exports as we traverse the export list, it's
possible we may find ourselves revisiting an export we just added. It's
harmless to reprocess those exports, as we're currently doing. But it's
also pointless.
(Actually, the current code appears to always add new export entries at
the head of each list, so we shouldn't hit this case. It still may be a
good idea to keep this check, though, as insulation against future
changes to that data structure.)
Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
J. Bruce Fields [Fri, 27 Nov 2009 20:01:12 +0000 (15:01 -0500)]
mountd: move most of get_exportlist() into helpers
I needed to understand get_exportlist() recently, and it gave me
trouble.
Move detail work into helper functions to make the basic logic clear,
and to remove need for excessive nesting (and fix inconsistent
indentation levels). Also remove unnecessary casts of void returns from
xmalloc().
Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
Steve Dickson [Tue, 1 Dec 2009 12:20:43 +0000 (07:20 -0500)]
exports: turn on pseudo exports
If a pseudo root is not defined in the export file, the
v4root_needed global variable will be set, signaling
v4root_set() create the dynamic pseudo root.
J. Bruce Fields [Thu, 24 Dec 2009 20:51:20 +0000 (15:51 -0500)]
mountd: prefer non-V4ROOT exports.
If paths A and A/B are both exported, then we have a choice of exports
to return for A (or under A but still above A/B): we could return A
itself, or we could return a V4ROOT export leading to B.
For now, we will always prefer the non-V4ROOT export, whenever that is
an option. This will allow clients to reach A/B as long as
adminstrators keep to the rule that the security on a parent permits the
union of the access permitted on any descendant.
In the future we may support more complicated arrangements.
(Note: this can't be avoided by simply not creating v4root exports with
the same domain and path, because different domains may have some
overlap.)
Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
Steve Dickson [Tue, 1 Dec 2009 12:16:13 +0000 (07:16 -0500)]
exports: NFSv4 pseudoroot support routines
Create v4root exports for each directory that is a parent of an explicit
export. Give each the minimal security required to traverse to any of
its children.
Signed-off-by: Steve Dickson <steved@redhat.com> Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
J. Bruce Fields [Tue, 22 Dec 2009 18:02:08 +0000 (13:02 -0500)]
mountd: don't require mountpoint in crossmnt case
Currently,
mount --bind /path /path
where /path is a subdirectory of a crossmnt export, can cause client
hangs, since the kernel detects that as a mountpoint, but nfs-util's
is_mountpoint() function does not.
I don't see any sure-fire way to detect such mountpoints. But that's
OK: it's harmless to allow this upcall to succeed even when the
directory is not a mountpoint, so let's just remove this check.
Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
J. Bruce Fields [Tue, 22 Dec 2009 16:22:58 +0000 (11:22 -0500)]
mountd: move export lookup into separate function
Move this main loop to a separate function, to make it a little easier
to follow the logic of the caller.
Also, instead of waiting till we find an export to do the dns
resolution, do it at the start; it will normally be needed anyway, and
this simplifies the control flow.
Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
J. Bruce Fields [Mon, 14 Dec 2009 22:07:19 +0000 (17:07 -0500)]
exports: let kernel decide which flags vary by flavor
Query the kernel to ask which flavors vary by pseudoflavor, and use that
instead of a fixed constant. To allow the possibility of more flags
varying by pseudoflavor, use the set/clear_flags functions for all
options instead of setting some by hand.
Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
projects / nfs-utils.git / log