2000-08-02 H.J. Lu <hjl@lucon.org>
[nfs-utils.git] / utils / mountd / auth.c
1 /*
2  * utils/mountd/auth.c
3  *
4  * Authentication procedures for mountd.
5  *
6  * Copyright (C) 1995, 1996 Olaf Kirch <okir@monad.swb.de>
7  */
8
9 #include "config.h"
10
11 #include <sys/stat.h>
12 #include <netinet/in.h>
13 #include <arpa/inet.h>
14 #include <errno.h>
15 #include "misc.h"
16 #include "nfslib.h"
17 #include "exportfs.h"
18 #include "mountd.h"
19 #include "xmalloc.h"
20
21 enum auth_error
22 {
23   bad_path,
24   unknown_host,
25   no_entry,
26   not_exported,
27   illegal_port,
28   faked_hostent,
29   no_forward_dns,
30   success
31 };
32
33 static void             auth_fixpath(char *path);
34 static nfs_export*      auth_authenticate_internal
35   (char *what, struct sockaddr_in *caller, char *path,
36    struct hostent **hpp, enum auth_error *error);
37 static char     *export_file = NULL;
38
39 void
40 auth_init(char *exports)
41 {
42
43         export_file = exports;
44         auth_reload();
45         xtab_mount_write();
46 }
47
48 int
49 auth_reload()
50 {
51         struct stat             stb;
52         static time_t           last_modified = 0;
53
54         if (stat(_PATH_ETAB, &stb) < 0)
55                 xlog(L_FATAL, "couldn't stat %s", _PATH_ETAB);
56         if (stb.st_mtime == last_modified)
57                 return 0;
58         last_modified = stb.st_mtime;
59
60         export_freeall();
61         // export_read(export_file);
62         xtab_export_read();
63
64         return 1;
65 }
66
67 static nfs_export *
68 auth_authenticate_internal(char *what, struct sockaddr_in *caller,
69                            char *path, struct hostent **hpp,
70                            enum auth_error *error)
71 {
72         struct in_addr          addr = caller->sin_addr;
73         nfs_export              *exp;
74
75         if (path[0] != '/') {
76                 *error = bad_path;
77                 return NULL;
78         }
79         auth_fixpath(path);
80
81         /* First try it w/o doing a hostname lookup... */
82         *hpp = get_hostent((const char *)&addr, sizeof(addr), AF_INET);
83         exp = export_find(*hpp, path);
84
85         if (!exp) {
86             /* Ok, that didn't fly.  Try it with a reverse lookup. */
87             free (*hpp);
88             *hpp = gethostbyaddr((const char *)&addr, sizeof(addr),
89                                  AF_INET);
90             if (!(*hpp)) {
91                 *error = no_entry;
92                 return NULL;
93             } else {
94                 /* must make sure the hostent is authorative. */
95                 char **sp;
96                 struct hostent *forward = NULL;
97                 char *tmpname;
98
99                 tmpname = xstrdup((*hpp)->h_name);
100                 if (tmpname) {
101                         forward = gethostbyname(tmpname);
102                         free(tmpname);
103                 }
104                 if (forward) {
105                         /* now make sure the "addr" is in the list */
106                         for (sp = forward->h_addr_list ; *sp ; sp++) {
107                                 if (memcmp(*sp, &addr, forward->h_length)==0)
108                                         break;
109                         }
110                 
111                         if (!*sp) {
112                                 /* it was a FAKE */
113                                 *error = faked_hostent;
114                                 *hpp = hostent_dup (*hpp);
115                                 return NULL;
116                         }
117                         *hpp = hostent_dup (forward);
118                 }
119                 else {
120                         /* never heard of it. misconfigured DNS? */
121                         *error = no_forward_dns;
122                         *hpp = hostent_dup (*hpp);
123                         return NULL;
124                 }
125             }
126
127             if (!(exp = export_find(*hpp, path))) {
128                 *error = no_entry;
129                 return NULL;
130             }
131         }
132
133         if (!exp->m_mayexport) {
134                 *error = not_exported;
135                 return NULL;
136         }
137
138         if (!(exp->m_export.e_flags & NFSEXP_INSECURE_PORT) &&
139             (ntohs(caller->sin_port) <  IPPORT_RESERVED/2 ||
140              ntohs(caller->sin_port) >= IPPORT_RESERVED)) {
141                 *error = illegal_port;
142                 return NULL;
143         }
144
145         *error = success;
146
147         return exp;
148 }
149
150 nfs_export *
151 auth_authenticate(char *what, struct sockaddr_in *caller, char *path)
152 {
153         nfs_export      *exp = NULL;
154         char            epath[MAXPATHLEN+1];
155         char            *p = NULL;
156         struct hostent  *hp = NULL;
157         struct in_addr  addr = caller->sin_addr;
158         enum auth_error error;
159
160         if (path [0] != '/') return exp;
161
162         strncpy(epath, path, sizeof (epath) - 1);
163         epath[sizeof (epath) - 1] = '\0';
164
165         /* Try the longest matching exported pathname. */
166         while (1) {
167                 if (hp) {
168                         free (hp);
169                         hp = NULL;
170                 }
171                 exp = auth_authenticate_internal(what, caller, epath,
172                                                  &hp, &error);
173                 if (exp || (error != not_exported && error != no_entry))
174                         break;
175                 /* We have to treat the root, "/", specially. */
176                 if (p == &epath[1]) break;
177                 p = strrchr(epath, '/');
178                 if (p == epath) p++;
179                 *p = '\0';
180         }
181
182         switch (error) {
183         case bad_path:
184                 xlog(L_WARNING, "bad path in %s request from %s: \"%s\"",
185                      what, inet_ntoa(addr), path);
186                 break;
187
188         case unknown_host:
189                 xlog(L_WARNING, "%s request from unknown host %s for %s (%s)",
190                      what, inet_ntoa(addr), path, epath);
191                 break;
192
193         case no_entry:
194                 xlog(L_WARNING, "refused %s request from %s for %s (%s): no export entry",
195                      what, hp->h_name, path, epath);
196                 break;
197
198         case not_exported:
199                 xlog(L_WARNING, "refused %s request from %s for %s (%s): not exported",
200                      what, hp->h_name, path, epath);
201                 break;
202
203         case illegal_port:
204                 xlog(L_WARNING, "refused %s request from %s for %s (%s): illegal port %d",
205                      what, hp->h_name, path, epath, ntohs(caller->sin_port));
206                 break;
207
208         case faked_hostent:
209                 xlog(L_WARNING, "refused %s request from %s (%s) for %s (%s): DNS forward lookup does't match with reverse",
210                      what, inet_ntoa(addr), hp->h_name, path, epath);
211                 break;
212
213         case no_forward_dns:
214                 xlog(L_WARNING, "refused %s request from %s (%s) for %s (%s): no DNS forward lookup",
215                      what, inet_ntoa(addr), hp->h_name, path, epath);
216                 break;
217
218         case success:
219                 xlog(L_NOTICE, "authenticated %s request from %s:%d for %s (%s)",
220                      what, hp->h_name, ntohs(caller->sin_port), path, epath);
221                 break;
222         default:
223                 xlog(L_NOTICE, "%s request from %s:%d for %s (%s) gave %d",
224                      what, hp->h_name, ntohs(caller->sin_port), path, epath, error);
225         }
226
227         if (hp)
228                 free (hp);
229
230         return exp;
231 }
232
233 static void
234 auth_fixpath(char *path)
235 {
236         char    *sp, *cp;
237
238         for (sp = cp = path; *sp; sp++) {
239                 if (*sp != '/' || sp[1] != '/')
240                         *cp++ = *sp;
241         }
242         while (cp > path+1 && cp[-1] == '/')
243                 cp--;
244         *cp = '\0';
245 }