]> git.decadent.org.uk Git - nfs-utils.git/blob - utils/mountd/auth.c
2001-11-21 Chip Salzenberg <chip@pobox.com>
[nfs-utils.git] / utils / mountd / auth.c
1 /*
2  * utils/mountd/auth.c
3  *
4  * Authentication procedures for mountd.
5  *
6  * Copyright (C) 1995, 1996 Olaf Kirch <okir@monad.swb.de>
7  */
8
9 #include "config.h"
10
11 #include <sys/stat.h>
12 #include <netinet/in.h>
13 #include <arpa/inet.h>
14 #include <errno.h>
15 #include "misc.h"
16 #include "nfslib.h"
17 #include "exportfs.h"
18 #include "mountd.h"
19 #include "xmalloc.h"
20
21 enum auth_error
22 {
23   bad_path,
24   unknown_host,
25   no_entry,
26   not_exported,
27   illegal_port,
28   faked_hostent,
29   no_forward_dns,
30   success
31 };
32
33 static void             auth_fixpath(char *path);
34 static nfs_export*      auth_authenticate_internal
35   (char *what, struct sockaddr_in *caller, char *path,
36    struct hostent **hpp, enum auth_error *error);
37 static char     *export_file = NULL;
38
39 void
40 auth_init(char *exports)
41 {
42
43         export_file = exports;
44         auth_reload();
45         xtab_mount_write();
46 }
47
48 int
49 auth_reload()
50 {
51         struct stat             stb;
52         static time_t           last_modified = 0;
53
54         if (stat(_PATH_ETAB, &stb) < 0)
55                 xlog(L_FATAL, "couldn't stat %s", _PATH_ETAB);
56         if (stb.st_mtime == last_modified)
57                 return 0;
58         last_modified = stb.st_mtime;
59
60         export_freeall();
61         // export_read(export_file);
62         xtab_export_read();
63
64         return 1;
65 }
66
67 static nfs_export *
68 auth_authenticate_internal(char *what, struct sockaddr_in *caller,
69                            char *path, struct hostent **hpp,
70                            enum auth_error *error)
71 {
72         struct in_addr          addr = caller->sin_addr;
73         nfs_export              *exp;
74
75         if (path[0] != '/') {
76                 *error = bad_path;
77                 return NULL;
78         }
79         auth_fixpath(path);
80
81         if (!(*hpp = gethostbyaddr((const char *)&addr, sizeof(addr), AF_INET)))
82                 *hpp = get_hostent((const char *)&addr, sizeof(addr),
83                                    AF_INET);
84         else {
85                 /* must make sure the hostent is authorative. */
86                 char **sp;
87                 struct hostent *forward = NULL;
88                 char *tmpname;
89
90                 *hpp = hostent_dup (*hpp);
91                 tmpname = xstrdup((*hpp)->h_name);
92                 if (tmpname) {
93                         forward = gethostbyname(tmpname);
94                         free(tmpname);
95                 }
96                 if (forward) {
97                         /* now make sure the "addr" is in the list */
98                         for (sp = forward->h_addr_list ; *sp ; sp++) {
99                                 if (memcmp(*sp, &addr, forward->h_length)==0)
100                                         break;
101                         }
102                 
103                         if (!*sp) {
104                                 /* it was a FAKE */
105                                 *error = faked_hostent;
106                                 return NULL;
107                         }
108                         free (*hpp);
109                         *hpp = hostent_dup (forward);
110                 }
111                 else {
112                         /* never heard of it. misconfigured DNS? */
113                         *error = no_forward_dns;
114                         return NULL;
115                 }
116         }
117
118         if (!(exp = export_find(*hpp, path))) {
119                 *error = no_entry;
120                 return NULL;
121         }
122         if (!exp->m_mayexport) {
123                 *error = not_exported;
124                 return NULL;
125         }
126
127         if (!(exp->m_export.e_flags & NFSEXP_INSECURE_PORT) &&
128             (ntohs(caller->sin_port) <  IPPORT_RESERVED/2 ||
129              ntohs(caller->sin_port) >= IPPORT_RESERVED)) {
130                 *error = illegal_port;
131                 return NULL;
132         }
133
134         *error = success;
135
136         return exp;
137 }
138
139 nfs_export *
140 auth_authenticate(char *what, struct sockaddr_in *caller, char *path)
141 {
142         nfs_export      *exp = NULL;
143         char            epath[MAXPATHLEN+1];
144         char            *p = NULL;
145         struct hostent  *hp = NULL;
146         struct in_addr  addr = caller->sin_addr;
147         enum auth_error error;
148
149         if (path [0] != '/') {
150                 xlog(L_WARNING, "bad path in %s request from %s: \"%s\"",
151                      what, inet_ntoa(addr), path);
152                 return exp;
153         }
154
155         strncpy(epath, path, sizeof (epath) - 1);
156         epath[sizeof (epath) - 1] = '\0';
157
158         /* Try the longest matching exported pathname. */
159         while (1) {
160                 if (hp) {
161                         free (hp);
162                         hp = NULL;
163                 }
164                 exp = auth_authenticate_internal(what, caller, epath,
165                                                  &hp, &error);
166                 if (exp || (error != not_exported && error != no_entry))
167                         break;
168                 /* We have to treat the root, "/", specially. */
169                 if (p == &epath[1]) break;
170                 p = strrchr(epath, '/');
171                 if (p == epath) p++;
172                 *p = '\0';
173         }
174
175         switch (error) {
176         case bad_path:
177                 xlog(L_WARNING, "bad path in %s request from %s: \"%s\"",
178                      what, inet_ntoa(addr), path);
179                 break;
180
181         case unknown_host:
182                 xlog(L_WARNING, "%s request from unknown host %s for %s (%s)",
183                      what, inet_ntoa(addr), path, epath);
184                 break;
185
186         case no_entry:
187                 xlog(L_WARNING, "refused %s request from %s for %s (%s): no export entry",
188                      what, hp->h_name, path, epath);
189                 break;
190
191         case not_exported:
192                 xlog(L_WARNING, "refused %s request from %s for %s (%s): not exported",
193                      what, hp->h_name, path, epath);
194                 break;
195
196         case illegal_port:
197                 xlog(L_WARNING, "refused %s request from %s for %s (%s): illegal port %d",
198                      what, hp->h_name, path, epath, ntohs(caller->sin_port));
199                 break;
200
201         case faked_hostent:
202                 xlog(L_WARNING, "refused %s request from %s (%s) for %s (%s): DNS forward lookup does't match with reverse",
203                      what, inet_ntoa(addr), hp->h_name, path, epath);
204                 break;
205
206         case no_forward_dns:
207                 xlog(L_WARNING, "refused %s request from %s (%s) for %s (%s): no DNS forward lookup",
208                      what, inet_ntoa(addr), hp->h_name, path, epath);
209                 break;
210
211         case success:
212                 xlog(L_NOTICE, "authenticated %s request from %s:%d for %s (%s)",
213                      what, hp->h_name, ntohs(caller->sin_port), path, epath);
214                 break;
215         default:
216                 xlog(L_NOTICE, "%s request from %s:%d for %s (%s) gave %d",
217                      what, hp->h_name, ntohs(caller->sin_port), path, epath, error);
218         }
219
220         if (hp)
221                 free (hp);
222
223         return exp;
224 }
225
226 static void
227 auth_fixpath(char *path)
228 {
229         char    *sp, *cp;
230
231         for (sp = cp = path; *sp; sp++) {
232                 if (*sp != '/' || sp[1] != '/')
233                         *cp++ = *sp;
234         }
235         while (cp > path+1 && cp[-1] == '/')
236                 cp--;
237         *cp = '\0';
238 }