utils/mountd/auth.c

   1 /*
   2  * utils/mountd/auth.c
   3  *
   4  * Authentication procedures for mountd.
   5  *
   6  * Copyright (C) 1995, 1996 Olaf Kirch <okir@monad.swb.de>
   7  */
   8
   9 #include "config.h"
  10
  11 #include <sys/stat.h>
  12 #include <netinet/in.h>
  13 #include <arpa/inet.h>
  14 #include <errno.h>
  15 #include "misc.h"
  16 #include "nfslib.h"
  17 #include "exportfs.h"
  18 #include "mountd.h"
  19 #include "xmalloc.h"
  20
  21 enum auth_error
  22 {
  23   bad_path,
  24   unknown_host,
  25   no_entry,
  26   not_exported,
  27   illegal_port,
  28   faked_hostent,
  29   no_forward_dns,
  30   success
  31 };
  32
  33 static void             auth_fixpath(char *path);
  34 static nfs_export*      auth_authenticate_internal
  35   (char *what, struct sockaddr_in *caller, char *path,
  36    struct hostent **hpp, enum auth_error *error);
  37 static char     *export_file = NULL;
  38
  39 void
  40 auth_init(char *exports)
  41 {
  42
  43         export_file = exports;
  44         auth_reload();
  45         xtab_mount_write();
  46 }
  47
  48 int
  49 auth_reload()
  50 {
  51         struct stat             stb;
  52         static time_t           last_modified = 0;
  53
  54         if (stat(_PATH_ETAB, &stb) < 0)
  55                 xlog(L_FATAL, "couldn't stat %s", _PATH_ETAB);
  56         if (stb.st_mtime == last_modified)
  57                 return 0;
  58         last_modified = stb.st_mtime;
  59
  60         export_freeall();
  61         // export_read(export_file);
  62         xtab_export_read();
  63
  64         return 1;
  65 }
  66
  67 static nfs_export *
  68 auth_authenticate_internal(char *what, struct sockaddr_in *caller,
  69                            char *path, struct hostent **hpp,
  70                            enum auth_error *error)
  71 {
  72         struct in_addr          addr = caller->sin_addr;
  73         nfs_export              *exp;
  74
  75         if (path[0] != '/') {
  76                 *error = bad_path;
  77                 return NULL;
  78         }
  79         auth_fixpath(path);
  80
  81         /* First try it w/o doing a hostname lookup... */
  82         *hpp = get_hostent((const char *)&addr, sizeof(addr), AF_INET);
  83         exp = export_find(*hpp, path);
  84
  85         if (!exp) {
  86             /* Ok, that didn't fly.  Try it with a reverse lookup. */
  87             free (*hpp);
  88             *hpp = gethostbyaddr((const char *)&addr, sizeof(addr),
  89                                  AF_INET);
  90             if (!(*hpp)) {
  91                 *error = no_entry;
  92                 *hpp = get_hostent((const char *)&addr, sizeof(addr), AF_INET);
  93                 return NULL;
  94             } else {
  95                 /* must make sure the hostent is authorative. */
  96                 char **sp;
  97                 struct hostent *forward = NULL;
  98                 char *tmpname;
  99
 100                 *hpp = hostent_dup (*hpp);
 101                 tmpname = xstrdup((*hpp)->h_name);
 102                 if (tmpname) {
 103                         forward = gethostbyname(tmpname);
 104                         free(tmpname);
 105                 }
 106                 if (forward) {
 107                         /* now make sure the "addr" is in the list */
 108                         for (sp = forward->h_addr_list ; *sp ; sp++) {
 109                                 if (memcmp(*sp, &addr, forward->h_length)==0)
 110                                         break;
 111                         }
 112
 113                         if (!*sp) {
 114                                 /* it was a FAKE */
 115                                 *error = faked_hostent;
 116                                 return NULL;
 117                         }
 118                         free (*hpp);
 119                         *hpp = hostent_dup (forward);
 120                 }
 121                 else {
 122                         /* never heard of it. misconfigured DNS? */
 123                         *error = no_forward_dns;
 124                         return NULL;
 125                 }
 126             }
 127
 128             if (!(exp = export_find(*hpp, path))) {
 129                 *error = no_entry;
 130                 return NULL;
 131             }
 132         }
 133
 134         if (!exp->m_mayexport) {
 135                 *error = not_exported;
 136                 return NULL;
 137         }
 138
 139         if (!(exp->m_export.e_flags & NFSEXP_INSECURE_PORT) &&
 140             (ntohs(caller->sin_port) <  IPPORT_RESERVED/2 ||
 141              ntohs(caller->sin_port) >= IPPORT_RESERVED)) {
 142                 *error = illegal_port;
 143                 return NULL;
 144         }
 145
 146         *error = success;
 147
 148         return exp;
 149 }
 150
 151 nfs_export *
 152 auth_authenticate(char *what, struct sockaddr_in *caller, char *path)
 153 {
 154         nfs_export      *exp = NULL;
 155         char            epath[MAXPATHLEN+1];
 156         char            *p = NULL;
 157         struct hostent  *hp = NULL;
 158         struct in_addr  addr = caller->sin_addr;
 159         enum auth_error error;
 160
 161         if (path [0] != '/') return exp;
 162
 163         strncpy(epath, path, sizeof (epath) - 1);
 164         epath[sizeof (epath) - 1] = '\0';
 165
 166         /* Try the longest matching exported pathname. */
 167         while (1) {
 168                 if (hp) {
 169                         free (hp);
 170                         hp = NULL;
 171                 }
 172                 exp = auth_authenticate_internal(what, caller, epath,
 173                                                  &hp, &error);
 174                 if (exp || (error != not_exported && error != no_entry))
 175                         break;
 176                 /* We have to treat the root, "/", specially. */
 177                 if (p == &epath[1]) break;
 178                 p = strrchr(epath, '/');
 179                 if (p == epath) p++;
 180                 *p = '\0';
 181         }
 182
 183         switch (error) {
 184         case bad_path:
 185                 xlog(L_WARNING, "bad path in %s request from %s: \"%s\"",
 186                      what, inet_ntoa(addr), path);
 187                 break;
 188
 189         case unknown_host:
 190                 xlog(L_WARNING, "%s request from unknown host %s for %s (%s)",
 191                      what, inet_ntoa(addr), path, epath);
 192                 break;
 193
 194         case no_entry:
 195                 xlog(L_WARNING, "refused %s request from %s for %s (%s): no export entry",
 196                      what, hp->h_name, path, epath);
 197                 break;
 198
 199         case not_exported:
 200                 xlog(L_WARNING, "refused %s request from %s for %s (%s): not exported",
 201                      what, hp->h_name, path, epath);
 202                 break;
 203
 204         case illegal_port:
 205                 xlog(L_WARNING, "refused %s request from %s for %s (%s): illegal port %d",
 206                      what, hp->h_name, path, epath, ntohs(caller->sin_port));
 207                 break;
 208
 209         case faked_hostent:
 210                 xlog(L_WARNING, "refused %s request from %s (%s) for %s (%s): DNS forward lookup does't match with reverse",
 211                      what, inet_ntoa(addr), hp->h_name, path, epath);
 212                 break;
 213
 214         case no_forward_dns:
 215                 xlog(L_WARNING, "refused %s request from %s (%s) for %s (%s): no DNS forward lookup",
 216                      what, inet_ntoa(addr), hp->h_name, path, epath);
 217                 break;
 218
 219         case success:
 220                 xlog(L_NOTICE, "authenticated %s request from %s:%d for %s (%s)",
 221                      what, hp->h_name, ntohs(caller->sin_port), path, epath);
 222                 break;
 223         default:
 224                 xlog(L_NOTICE, "%s request from %s:%d for %s (%s) gave %d",
 225                      what, hp->h_name, ntohs(caller->sin_port), path, epath, error);
 226         }
 227
 228         if (hp)
 229                 free (hp);
 230
 231         return exp;
 232 }
 233
 234 static void
 235 auth_fixpath(char *path)
 236 {
 237         char    *sp, *cp;
 238
 239         for (sp = cp = path; *sp; sp++) {
 240                 if (*sp != '/' || sp[1] != '/')
 241                         *cp++ = *sp;
 242         }
 243         while (cp > path+1 && cp[-1] == '/')
 244                 cp--;
 245         *cp = '\0';
 246 }