utils/mountd/auth.c

   1 /*
   2  * utils/mountd/auth.c
   3  *
   4  * Authentication procedures for mountd.
   5  *
   6  * Copyright (C) 1995, 1996 Olaf Kirch <okir@monad.swb.de>
   7  */
   8
   9 #include "config.h"
  10
  11 #include <sys/stat.h>
  12 #include <netinet/in.h>
  13 #include <arpa/inet.h>
  14 #include <errno.h>
  15 #include "misc.h"
  16 #include "nfslib.h"
  17 #include "exportfs.h"
  18 #include "mountd.h"
  19 #include "xmalloc.h"
  20
  21 enum auth_error
  22 {
  23   bad_path,
  24   unknown_host,
  25   no_entry,
  26   not_exported,
  27   illegal_port,
  28   faked_hostent,
  29   no_forward_dns,
  30   success
  31 };
  32
  33 static void             auth_fixpath(char *path);
  34
  35 extern int new_cache;
  36
  37 void
  38 auth_init(char *exports)
  39 {
  40
  41         auth_reload();
  42         xtab_mount_write();
  43 }
  44
  45 int
  46 auth_reload()
  47 {
  48         struct stat             stb;
  49         static time_t           last_modified = 0;
  50
  51         if (stat(_PATH_ETAB, &stb) < 0)
  52                 xlog(L_FATAL, "couldn't stat %s", _PATH_ETAB);
  53         if (stb.st_mtime == last_modified)
  54                 return 0;
  55         last_modified = stb.st_mtime;
  56
  57         export_freeall();
  58         xtab_export_read();
  59
  60         return 1;
  61 }
  62
  63 static nfs_export *
  64 auth_authenticate_internal(char *what, struct sockaddr_in *caller,
  65                            char *path, struct hostent *hp,
  66                            enum auth_error *error)
  67 {
  68         struct in_addr          addr = caller->sin_addr;
  69         nfs_export              *exp;
  70
  71         static nfs_export my_exp;
  72         static nfs_client my_client;
  73
  74         if (new_cache) {
  75                 int i;
  76                 /* return static nfs_export with details filled in */
  77                 if (my_client.m_naddr != 1 ||
  78                     my_client.m_addrlist[0].s_addr != caller->sin_addr.s_addr) {
  79                         char *n;
  80                         my_client.m_naddr = 0;
  81                         my_client.m_addrlist[0] = caller->sin_addr;
  82                         n = client_compose(addr);
  83                         if (!n)
  84                                 return NULL;
  85                         strcpy(my_client.m_hostname, *n?n:"DEFAULT");
  86                         free(n);
  87                         my_client.m_naddr = 1;
  88                 }
  89
  90                 my_exp.m_client = &my_client;
  91
  92                 exp = NULL;
  93                 for (i = 0; !exp && i < MCL_MAXTYPES; i++)
  94                         for (exp = exportlist[i]; exp; exp = exp->m_next) {
  95                                 if (!client_member(my_client.m_hostname, exp->m_client->m_hostname))
  96                                         continue;
  97                                 if (strcmp(path, exp->m_export.e_path))
  98                                         continue;
  99                                 break;
 100                         }
 101                 *error = not_exported;
 102                 if (!exp)
 103                         return exp;
 104
 105                 my_exp.m_export = exp->m_export;
 106                 exp = &my_exp;
 107         } else {
 108
 109                 if (!(exp = export_find(hp, path))) {
 110                         *error = no_entry;
 111                         return NULL;
 112                 }
 113                 if (!exp->m_mayexport) {
 114                         *error = not_exported;
 115                         return NULL;
 116                 }
 117
 118                 if (!(exp->m_export.e_flags & NFSEXP_INSECURE_PORT) &&
 119                     (ntohs(caller->sin_port) <  IPPORT_RESERVED/2 ||
 120                      ntohs(caller->sin_port) >= IPPORT_RESERVED)) {
 121                         *error = illegal_port;
 122                         return NULL;
 123                 }
 124
 125         }
 126         *error = success;
 127
 128         return exp;
 129 }
 130
 131 nfs_export *
 132 auth_authenticate(char *what, struct sockaddr_in *caller, char *path)
 133 {
 134         nfs_export      *exp = NULL;
 135         char            epath[MAXPATHLEN+1];
 136         char            *p = NULL;
 137         struct hostent  *hp = NULL;
 138         struct in_addr  addr = caller->sin_addr;
 139         enum auth_error error;
 140
 141         if (path [0] != '/') {
 142                 xlog(L_WARNING, "bad path in %s request from %s: \"%s\"",
 143                      what, inet_ntoa(addr), path);
 144                 return exp;
 145         }
 146
 147         strncpy(epath, path, sizeof (epath) - 1);
 148         epath[sizeof (epath) - 1] = '\0';
 149         auth_fixpath(epath);/* strip dup '/' etc */
 150
 151         hp = get_reliable_hostbyaddr((const char*)&caller->sin_addr, sizeof(struct in_addr),
 152                                      AF_INET);
 153         if (!hp)
 154                 hp = get_hostent((const char*)&caller->sin_addr, sizeof(struct in_addr),
 155                                      AF_INET);
 156         if (!hp)
 157                 return exp;
 158         /* Try the longest matching exported pathname. */
 159         while (1) {
 160                 exp = auth_authenticate_internal(what, caller, epath,
 161                                                  hp, &error);
 162                 if (exp || (error != not_exported && error != no_entry))
 163                         break;
 164                 /* We have to treat the root, "/", specially. */
 165                 if (p == &epath[1]) break;
 166                 p = strrchr(epath, '/');
 167                 if (p == epath) p++;
 168                 *p = '\0';
 169         }
 170         free(hp);
 171
 172         switch (error) {
 173         case bad_path:
 174                 xlog(L_WARNING, "bad path in %s request from %s: \"%s\"",
 175                      what, inet_ntoa(addr), path);
 176                 break;
 177
 178         case unknown_host:
 179                 xlog(L_WARNING, "%s request from unknown host %s for %s (%s)",
 180                      what, inet_ntoa(addr), path, epath);
 181                 break;
 182
 183         case no_entry:
 184                 xlog(L_WARNING, "refused %s request from %s for %s (%s): no export entry",
 185                      what, hp->h_name, path, epath);
 186                 break;
 187
 188         case not_exported:
 189                 xlog(L_WARNING, "refused %s request from %s for %s (%s): not exported",
 190                      what, hp->h_name, path, epath);
 191                 break;
 192
 193         case illegal_port:
 194                 xlog(L_WARNING, "refused %s request from %s for %s (%s): illegal port %d",
 195                      what, hp->h_name, path, epath, ntohs(caller->sin_port));
 196                 break;
 197
 198         case faked_hostent:
 199                 xlog(L_WARNING, "refused %s request from %s (%s) for %s (%s): DNS forward lookup does't match with reverse",
 200                      what, inet_ntoa(addr), hp->h_name, path, epath);
 201                 break;
 202
 203         case no_forward_dns:
 204                 xlog(L_WARNING, "refused %s request from %s (%s) for %s (%s): no DNS forward lookup",
 205                      what, inet_ntoa(addr), hp->h_name, path, epath);
 206                 break;
 207
 208         case success:
 209                 xlog(L_NOTICE, "authenticated %s request from %s:%d for %s (%s)",
 210                      what, hp->h_name, ntohs(caller->sin_port), path, epath);
 211                 break;
 212         default:
 213                 xlog(L_NOTICE, "%s request from %s:%d for %s (%s) gave %d",
 214                      what, hp->h_name, ntohs(caller->sin_port), path, epath, error);
 215         }
 216
 217         if (hp)
 218                 free (hp);
 219
 220         return exp;
 221 }
 222
 223 /*
 224  * Remove duplicate and trailing '/' (Except for leading slash)
 225  */
 226 static void
 227 auth_fixpath(char *path)
 228 {
 229         char    *sp, *cp;
 230
 231         for (sp = cp = path; *sp; sp++) {
 232                 if (*sp != '/' || sp[1] != '/')
 233                         *cp++ = *sp;
 234         }
 235         while (cp > path+1 && cp[-1] == '/')
 236                 cp--;
 237         *cp = '\0';
 238 }