Assorted fixes
[nfs-utils.git] / utils / mountd / auth.c
1 /*
2  * utils/mountd/auth.c
3  *
4  * Authentication procedures for mountd.
5  *
6  * Copyright (C) 1995, 1996 Olaf Kirch <okir@monad.swb.de>
7  */
8
9 #include "config.h"
10
11 #include <sys/stat.h>
12 #include <netinet/in.h>
13 #include <arpa/inet.h>
14 #include <errno.h>
15 #include "misc.h"
16 #include "nfslib.h"
17 #include "exportfs.h"
18 #include "mountd.h"
19 #include "xmalloc.h"
20
21 enum auth_error
22 {
23   bad_path,
24   unknown_host,
25   no_entry,
26   not_exported,
27   illegal_port,
28   success
29 };
30
31 static void             auth_fixpath(char *path);
32 static char     *export_file = NULL;
33
34 extern int new_cache;
35
36 void
37 auth_init(char *exports)
38 {
39
40         export_file = exports;
41         auth_reload();
42         xtab_mount_write();
43 }
44
45 int
46 auth_reload()
47 {
48         struct stat             stb;
49         static time_t           last_modified = 0;
50
51         if (stat(_PATH_ETAB, &stb) < 0)
52                 xlog(L_FATAL, "couldn't stat %s", _PATH_ETAB);
53         if (stb.st_mtime == last_modified)
54                 return 0;
55         last_modified = stb.st_mtime;
56
57         export_freeall();
58         // export_read(export_file);
59         xtab_export_read();
60
61         return 1;
62 }
63
64 static nfs_export *
65 auth_authenticate_internal(char *what, struct sockaddr_in *caller,
66                            char *path, struct hostent *hp,
67                            enum auth_error *error)
68 {
69         nfs_export              *exp;
70
71         if (new_cache) {
72                 static nfs_export my_exp;
73                 static nfs_client my_client;
74                 int i;
75                 /* return static nfs_export with details filled in */
76                 if (my_client.m_naddr != 1 ||
77                     my_client.m_addrlist[0].s_addr != caller->sin_addr.s_addr) {
78                         /* different client to last time, so do a lookup */
79                         char *n;
80                         my_client.m_naddr = 0;
81                         my_client.m_addrlist[0] = caller->sin_addr;
82                         n = client_compose(caller->sin_addr);
83                         if (!n)
84                                 return NULL;
85                         strcpy(my_client.m_hostname, *n?n:"DEFAULT");
86                         free(n);
87                         my_client.m_naddr = 1;
88                 }
89
90                 my_exp.m_client = &my_client;
91
92                 exp = NULL;
93                 for (i = 0; !exp && i < MCL_MAXTYPES; i++) 
94                         for (exp = exportlist[i]; exp; exp = exp->m_next) {
95                                 if (!client_member(my_client.m_hostname, exp->m_client->m_hostname))
96                                         continue;
97                                 if (strcmp(path, exp->m_export.e_path))
98                                         continue;
99                                 break;
100                         }
101                 *error = not_exported;
102                 if (!exp)
103                         return exp;
104
105                 my_exp.m_export = exp->m_export;
106                 exp = &my_exp;
107
108         } else {
109                 if (!(exp = export_find(hp, path))) {
110                         *error = no_entry;
111                         return NULL;
112                 }
113                 if (!exp->m_mayexport) {
114                         *error = not_exported;
115                         return NULL;
116                 }
117         }
118         if (!(exp->m_export.e_flags & NFSEXP_INSECURE_PORT) &&
119                     (ntohs(caller->sin_port) <  IPPORT_RESERVED/2 ||
120                      ntohs(caller->sin_port) >= IPPORT_RESERVED)) {
121                 *error = illegal_port;
122                 return NULL;
123         }
124         *error = success;
125
126         return exp;
127 }
128
129 nfs_export *
130 auth_authenticate(char *what, struct sockaddr_in *caller, char *path)
131 {
132         nfs_export      *exp = NULL;
133         char            epath[MAXPATHLEN+1];
134         char            *p = NULL;
135         struct hostent  *hp = NULL;
136         struct in_addr  addr = caller->sin_addr;
137         enum auth_error error;
138
139         if (path [0] != '/') {
140                 xlog(L_WARNING, "bad path in %s request from %s: \"%s\"",
141                      what, inet_ntoa(addr), path);
142                 return exp;
143         }
144
145         strncpy(epath, path, sizeof (epath) - 1);
146         epath[sizeof (epath) - 1] = '\0';
147         auth_fixpath(epath); /* strip duplicate '/' etc */
148
149         hp = get_reliable_hostbyaddr((const char*)&caller->sin_addr, sizeof(struct in_addr),
150                                      AF_INET);
151         if (!hp)
152                 hp = get_hostent((const char*)&caller->sin_addr, sizeof(struct in_addr),
153                                      AF_INET);
154         if (!hp)
155                 return exp;
156
157         /* Try the longest matching exported pathname. */
158         while (1) {
159                 exp = auth_authenticate_internal(what, caller, epath,
160                                                  hp, &error);
161                 if (exp || (error != not_exported && error != no_entry))
162                         break;
163                 /* We have to treat the root, "/", specially. */
164                 if (p == &epath[1]) break;
165                 p = strrchr(epath, '/');
166                 if (p == epath) p++;
167                 *p = '\0';
168         }
169
170         switch (error) {
171         case bad_path:
172                 xlog(L_WARNING, "bad path in %s request from %s: \"%s\"",
173                      what, inet_ntoa(addr), path);
174                 break;
175
176         case unknown_host:
177                 xlog(L_WARNING, "%s request from unknown host %s for %s (%s)",
178                      what, inet_ntoa(addr), path, epath);
179                 break;
180
181         case no_entry:
182                 xlog(L_WARNING, "refused %s request from %s for %s (%s): no export entry",
183                      what, hp->h_name, path, epath);
184                 break;
185
186         case not_exported:
187                 xlog(L_WARNING, "refused %s request from %s for %s (%s): not exported",
188                      what, hp->h_name, path, epath);
189                 break;
190
191         case illegal_port:
192                 xlog(L_WARNING, "refused %s request from %s for %s (%s): illegal port %d",
193                      what, hp->h_name, path, epath, ntohs(caller->sin_port));
194                 break;
195
196         case success:
197                 xlog(L_NOTICE, "authenticated %s request from %s:%d for %s (%s)",
198                      what, hp->h_name, ntohs(caller->sin_port), path, epath);
199                 break;
200         default:
201                 xlog(L_NOTICE, "%s request from %s:%d for %s (%s) gave %d",
202                      what, hp->h_name, ntohs(caller->sin_port), path, epath, error);
203         }
204
205         if (hp)
206                 free (hp);
207
208         return exp;
209 }
210
211 static void
212 auth_fixpath(char *path)
213 {
214         char    *sp, *cp;
215
216         for (sp = cp = path; *sp; sp++) {
217                 if (*sp != '/' || sp[1] != '/')
218                         *cp++ = *sp;
219         }
220         while (cp > path+1 && cp[-1] == '/')
221                 cp--;
222         *cp = '\0';
223 }